1

Possible Duplicates:
How does one figure out what process locked a file using c#?
How do I find out which process is locking a file using .NET?

Hi,

i try to get the name of the process wich locks a file (not only a dll module, any file). For example if process "Process A" opens a file stream on "C:\temp\test.txt" this should be detected (if i try to delete the file in windows explorer it is locked till the process is killed).

There are several examples on Stackoverflow like: How does one figure out what process locked a file using c#?
Determine which process (b)locks a file, programmatically (under Windows >= XP)

I tryed the examples above, but none of them works.

I also read somethink about the Win32 API function NtQuerySystemInformation, but i don't know how how to use it. Couldn't find any PInvoke code for it.

Community
  • 1
  • 1
Alexander
  • 3,724
  • 8
  • 42
  • 50
  • 1
    "none of them works" - please elaborate. Are the answers incorrect, did you not understand them, are they not applicable (if then, how so), or what? – bzlm Jan 02 '11 at 13:34
  • They always return an empty result for any process. – Alexander Jan 02 '11 at 13:43
  • ... and loading all modules for a process does not make any sens for me if i try to determin who locks a text file. right? – Alexander Jan 02 '11 at 13:44
  • 1
    @Alexander Even the answers invoking `handle.exe`? Or is that not applicable here? (Also, please use comment reply indicators when replying.) – bzlm Jan 02 '11 at 13:46
  • `NtQuerySystemInformation` doesn't provide this information. Nor does any other Win32 API. To get this information you need to read kernel data structures, which means injecting a driver... which is only possible via unsupported approaches (and administrator equivalent privileges). So see duplicate Q: call [`handle`](http://technet.microsoft.com/en-gb/sysinternals/bb896655) and parse the results. – Richard Jan 02 '11 at 14:02
  • 1
    To expand a little on why only the kernel has this information: processes operate on files, sockets, named pipes, ... via kernel handles. As kernel handles can be duplicated from one process to another even the process that has the handle cannot, in general, determine what file it is (or even if it is a file). – Richard Jan 02 '11 at 14:05
  • Parsing the output of "handle.exe" works, but i prefer to do it with native code. Isn't there any way to do this with with Win32 API? I am sure this is possible without injecting a kernel driver. There is a tool named "Unlocker" which does exactly what i want to do without installing any kernel driver. – Alexander Jan 02 '11 at 19:09

2 Answers2

1

I use Process Explorer from SysInternals (It doesn't not require installation, it's a single exe).

  1. Ctrl+F (Find handle or dll)
  2. Type the name of the locked file
Daniel Peñalba
  • 30,507
  • 32
  • 137
  • 219
-1

As already mentioned in the comment (by bzlm and Richard), handle.exe should work for you.

Vikram.exe
  • 4,565
  • 3
  • 29
  • 40