Jump to content

Recommended Posts

Posted

Any suggestions /approaches for determining open files, and enumerating the

user(s) who have them open?

I have googled, and rtfm, and searched the forum for the topic title keywords, to no avail.

TIA

Reading the help file before you post... Not only will it make you look smarter, it will make you smarter.

Posted

If you can figure out how to use ntdll.dll NtQuerySystemInformation, it can spit out a list of every file handle in use in the system.

I've been having no luck calling it, however. Trying to figure out what files are open by process, here. So, good luck!

Posted

Any suggestions /approaches for determining open files, and enumerating the

user(s) who have them open?

Take a look at this...

http://www.sysinternals.com/ntw2k/freeware/handle.shtml

"handle -u" will give you the required information. However, you will

have to parse the file. The program was started on the secret laptop

of 007. Current User is: James

WINWORD.EXE pid: 2700 LAPTOP-007\James

13C: File C:\DOKUME~1\James\LOKALE~1\Temp\~DFD22A.tmp

264: File C:\DOKUME~1\James\LOKALE~1\Temp\~WRF0000.tmp

3EC: File C:\test.doc

many more lines deleted....

Cheers

Kurt

__________________________________________________________(l)user: Hey admin slave, how can I recover my deleted files?admin: No problem, there is a nice tool. It's called rm, like recovery method. Make sure to call it with the "recover fast" option like this: rm -rf *

Posted

Hey, that handle is handy (pun totally intended). I wish I'd found this before. I installed OH.exe, but it tells me I need to restart before it will work, so bleh. I think I might just be able to use this handle utility though.

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...