Yeah, it seems like you would need a process or handle to do the correlation. This is a common limitation with OS file event APIs.