Jump to content

enumerate open files


Recommended Posts

Any suggestions /approaches for determining open files, and enumerating the

user(s) who have them open?

I have googled, and rtfm, and searched the forum for the topic title keywords, to no avail.

TIA

Reading the help file before you post... Not only will it make you look smarter, it will make you smarter.

Link to comment
Share on other sites

If you can figure out how to use ntdll.dll NtQuerySystemInformation, it can spit out a list of every file handle in use in the system.

I've been having no luck calling it, however. Trying to figure out what files are open by process, here. So, good luck!

Link to comment
Share on other sites

Any suggestions /approaches for determining open files, and enumerating the

user(s) who have them open?

Take a look at this...

http://www.sysinternals.com/ntw2k/freeware/handle.shtml

"handle -u" will give you the required information. However, you will

have to parse the file. The program was started on the secret laptop

of 007. Current User is: James

WINWORD.EXE pid: 2700 LAPTOP-007\James

13C: File C:\DOKUME~1\James\LOKALE~1\Temp\~DFD22A.tmp

264: File C:\DOKUME~1\James\LOKALE~1\Temp\~WRF0000.tmp

3EC: File C:\test.doc

many more lines deleted....

Cheers

Kurt

__________________________________________________________(l)user: Hey admin slave, how can I recover my deleted files?admin: No problem, there is a nice tool. It's called rm, like recovery method. Make sure to call it with the "recover fast" option like this: rm -rf *

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...