35

Is there a way to list all files that are currently opened by a specific process in Windows?

I mean files that got have an fopen, but never got an fclose by a specific process.

I tried to use Sysinternals Process Monitor, but I couldn't figure out how to list the current opened files – but only when the opening happens.

Improve this question
2
  • Related question (with relevant answers to this question): stackoverflow.com/questions/15708/lsof-equivalent-for-windows
    – Anderson Green
    Feb 22, 2013 at 19:43
  • One thing that is missing in answers to the question in the title: Seeing which files are opened at the beginning of launch. With strace on Linux, you can run strace ls and it will show you every single file opened from initialization. I'm here because this question ranks well and is titled generically enough, but gives no answer to my issue: Finding out what files are opened by a process that lasts less than 2 seconds. Process Explorer is especially frustrating here.
    – joshfindit
    Oct 3, 2022 at 21:56

4 Answers 4

Reset to default
24

You could try Sysinternals Process Explorer instead of Process Monitor. Process Monitor is design for watching what processes do as they do then. Process Explorer is more for seeing the current state of processes; it's Task Manager but with about 10x the functionality.

Sysinternals also have handle.exe which is a command line tool that tells you which files a process has open.

Improve this answer
42

Check out Process Explorer from Sysinternals.

To see the open files for a process, select a process from the list, select the View->Lower Panel View->Handles menu option. All of the handles of type "File" are the open files.

Also, a great way to find which application has a file open is by using the Find->Handle or DLL menu option. Just enter the name of the file you are looking for and hit "Search" to find the processes with a file open matching the search string.

Improve this answer
2
  • 4
    +1 for anything from Sysinternals... btw, a direct link: live.sysinternals.com/procexp.exe
    – fretje
    Sep 29, 2009 at 13:33
  • +1 for addressing his problem with the tools he's using. IMO this should be the correct answer. There is no need to use handle.exe when you are already using and familiar with process explorer.
    – BoldAsLove
    Nov 29, 2018 at 16:12
10

Process Explorer from Sysinternals is actually pretty useless when it comes to dealing with file handles (as opposed to DLL's, etc.). Use Windows Resource Monitor, click on CPU tab. Next to Associated Handles type the name of the file and you will see who has it open.

Improve this answer
1
  • read @heavyd answer, its not useless. The second part is still a valid solution.
    – BoldAsLove
    Nov 29, 2018 at 16:14
-3

As Dave rightly said, use Process Explorer from SysInternals, apart from that they offer varying set of utils. Checkout: http://technet.microsoft.com/en-us/sysinternals/bb842062.aspx

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .