2
  1. In Windows if I want to check what process is using a file I can use programs such as Process Hacker and its search function to type the name of that file.

    From the information it provides I know a process is doing something with that file but I don't know if it locked it, or if it's just reading it or writing on it. How can I get that information?

  2. More important, what about the opposite? I want to find the name of the files being locked or written or read by a process.

    How can I do it?

In the following screenshot you can see how easy is to find the process name from the file name, but how can I find the name of the files used by a given process?

enter image description here

In this example I'm using Acrobat to open a PDF file called eemeir.pdf, but this doens't get listed on the Acrobat process tree.

With Process Explorer is the same:

enter image description here

PD: @user173724 suggested how to do it using Process Explorer, and I've also found how to do it with PH:

I need to select the option “View -> Window” and a very large list of information appear.

But it's very ugly and not comfortable to find anything there (the same goes for Process Explorer), it doesn't have a search function in this section.

Also Right+clicking on a “Process -> Properties -> Handles.”

2
  • I don't see an on topic question in your question. So what is it?
    – Ramhound
    Jul 17, 2016 at 14:33
  • I don't understand your question
    – skan
    Jul 17, 2016 at 15:44

3 Answers 3

1

There is a Microsoft utility called process explorer that is like task manager on steroids. Clicking on a program listed shows all files being accessed, and it's search function allows you to find what program is accessing a file.

3
  • Process Explorer is basically the same (though I think PH is more powerful showing hidden processes). I also have it installed and as you can see (I've updated my question with a new screenshot) it shows the same information. It doesn't seem to show information on what files are being used/locked/read/written by that process.
    – skan
    Jul 17, 2016 at 14:46
  • 1
    On process explorer go to view->show lower pane Jul 17, 2016 at 14:50
  • OK, I've found, thanks. I've also found it in Process Hacker
    – skan
    Jul 17, 2016 at 15:09
1

On the question #2:

To find the name of the files being locked or written or read by a process

double-click the process and go to "Handles" tab (this doesn't require any PH plugin). You are interested in rows with Type = "File".

On the question #1:

Just as in answer above, you need to locate the process, double-click it, navigate to "Handles" tab, and locate the file there.

Then, if you double click the file's handle, you will see Granted Access. E.g. if you try this on Excel, "Granted Access" is "Read" for TTF files (these are fonts, Excel doesn't modify them obviously), but "(Write, Read, Delete)" for XSLX files or other user data files.

0

Alternatively you can use the sysinternals handle command (https://technet.microsoft.com/en-us/sysinternals/handle) which is part of the same suite.

handle c:\windows

shows all processes using windows or on of the files below that directory.

In the current version 4.1 you do not need to be an administrator user if you're only interested in your own processes. You still need elevation to see all processes using a file / directory.

1
  • Is there any way to hook handle to a certain directory or a process before it started?
    – Starhowl
    Dec 5, 2019 at 20:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.