Find open file handles for a process.

Question

I need to discover what file handles a process has open. The best example is what system internals ProcessExplorer does.
However they use NtQuerySystemInformation which it a C++ call.

While I'm not against wrapping the call I figure there must be a direct C# call.

The closest c# option I can find is WMI calls.
Win32_Process will tell me what processes I'm running but it won't tell me what file handles I have open.

Question:
1) Is there a WMI call that can tell me what File Handles are open? Either for a given process or at least what PID is holding the file handle?
2) Is there any other call I can do to copmlete this task?



Answer 1

Check this project.   In case it isn't clear, it uses private kernel structures that are different in each version of Windows.  Relying on this in production software is very unwise.

---

Hans Passant.

Answer 2

Ya, I've actually already started using this particular project. It covers what I need but it's not in C# and as you point out, its never going to be forwards compatible.

Answer 3

Hello

NtQuerySystemInformation is not recommended to use in applications, so I do not suggest it even though you may be able to P/Invoke the API from C#.

I'm not aware of a WMI class that can tell what file handles are open. May I know the business requirement behind the request of enumerating open file handles for a process? If you want to find out who has a file open, you may propably try the restart manager API which is available in Windows Vista and later operating systems.

http://msdn.microsoft.com/en-us/library/aa373524(VS.85).aspx
The primary reason software installation and updates require a system restart is that some of the files that are being updated are currently being used by a running application or service. Restart Manager enables all but the critical applications and services to be shut down and restarted . This frees the files that are in use and allows installation operations to complete. It can also eliminate or reduce the number of system restarts that are required to complete an installation or update.

Another idea is to redirect stdIO of handle.exe utility
http://technet.microsoft.com/en-us/sysinternals/bb896655.aspx
and parse its output to get the opened files of a process. However, third party applications are not allowed to distribute the tool:

http://technet.microsoft.com/en-us/sysinternals/bb847944.aspx
Q: May I distribute Sysinternals utilities in my software, on my website, or with my magazine?
A: No. We are not offering any distribution licenses, even if the 3rd party is distributing them for free. We encourage people to download the utilities from our download center where they can be assured to get the most recent version of the utility.

Regards,
Jialiang Ge

---

Please remember to mark the replies as answers if they help and unmark them if they provide no help.
Welcome to the All-In-One Code Framework! If you have any feedback, please tell us.

Answer 4

Hello asdf989

May I know whether the above suggestions were helpful to you? If you have any other questions, please feel free to post here.

Regards
Jialiang Ge

---

Please remember to mark the replies as answers if they help and unmark them if they provide no help.
Welcome to the All-In-One Code Framework! If you have any feedback, please tell us.

Answer 5

NoNugz response about that example project was the most helpful so far. Using it you can request all the processes to get the PIDs. Likewise you can get all the open File Handles, and their PIDs and then map file handles to processes.

I'm dissappointed that there's no .Net solution as I could get all the processes and their PIDS, but not the file handles.

Answer 6

Jialiang,

 

We have a tool that wants to overwrite a folder programmatically. Our system maintains state in that folder. We don't want to start the overwriting process if there is an open handle on any file under the folder. So we want to make a call that returns if a handle is open on any file under that folder. 

We don't want to close any handles. We just want to know if we will be able to delete the folder at all before attempting to.

Do you have a workaround?

 

Thanks,

Julio

Answer 7

Why not just try and delete the folder and trap the error?

---

Mark Burns, MCAD, MCP
Sr. Microsoft Access Analyst/Developer
Manager LinkedIn.Com community: Professional Microsoft Access Developers Network (PMADN)

Answer 8

Hi Jialiang and Mark,

I met the similar problem in Hyper-V on Windows 2012 Server. The Virtual Machine  might became zombie if I made a mistake on manipulate it. The VM did not show on hyper-V manager. Its process "vmwp" show in "Task Manager". I killed the vmwp. But some files registered in Hyper-V were still hold by vmms, the service of "Hyper-V Virtual Machine Management".  Those files were shown in "Process Explorer - Sysinternals" program. 

Is it possible to close those files' handler without restart/stop vmms service programmatically?  My program is written in C#. How can I find the file handler by given full file name?

Regards,

Guangjie