Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an issue with Mac's and a windows SMB share, when using Excel 2011.

If I open an excel document from the windows share it will create a "Ghost file" starting with ~$ then the full filename e.g ::

If I opened testdoc.xlsx a ghost file will be created called ~$testdoc.xlsx this is not a major issue as when the document is closed the file is removed.

This file becomes a problem when my users are working through the VPN and if they disconnect their VPN without closing the excell document the "Ghost" file is left behind and then anyone on a mac can only open the file read only until this ghost file is removed.

I have tried using the apple command ::

defaults write DSDontWriteNetworkStores true

This stop's the macs writing resource forks and DS store files to the network files but does not stop this ghost file creation.

Does anyone know what these files are? How to stop them being created? Is it safe to stop them?

Kind regards

share|improve this question
I think those are the auto-backup files, if so, the only way to get rid of them would be disabling auto-backup. – terdon Dec 13 '12 at 12:44
Thanks for the comment, I disabled Auto backup but the file still remains, as soon as the document is opened it appears. – Kevin Dec 13 '12 at 13:34

The other thing that occurs to me, since it is not the backup, is that it is a lockfile whose function is to prevent other users writing to the file if it is already open for writing, which is not a bad idea.

Clearly, the best solution would be to make your users act responsibly but that, of course, is a lost cause :).

So, what I would do is run a little cronjob that would search for such files, check if the file in question is currently open, and if not, remove the lockfile. The problem is that the only way I know of to check whether a file is open is lsof which lists the processes that are currently accessing a given file. However, this will only work if run from the computer that is currently accessing the file, not from the server. If you run it on the server and your user has it open on her local machine it will not return any output.

Depending on your setup, you may be able to extend this by checking which user created the lockfile, and running the script on their machine instead. So, in the hope that it will be useful, here is the script that will remove lockfiles referring to files that are not open by any programs on the current machine:

## Define the regular expression we will use

## Find all files that begin with "~\$*" in the directory
## specified on the command line, the lockfiles
find ${@} -name "~\$*" -print0 2>/dev/null | while IFS= read -r -d '' file; do

    if [[ $file =~ $regex ]]
        ## Get the name of the file that created the lockfile
        ## Check if the file is currently open
        isopen=`lsof "$realname" 2>/dev/null | wc -l`
        ## If the file is not open (by a program running on the
        ## same machine as this script, delete the lockfile
        if (( $isopen == 0))
            echo "Deleting $file..."
            rm "$file"
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.