How can I find the name of the process that has a certain file in use?

[Marcel Brekelmans]

Hi,

Is there a way to find the name of the process that has a file open? I know
of tools, like Unlocker, that can do it, so I assume there are some
systemcalls that can help me out.

Thanks.

 

[Willy Denoyette [MVP]]

Hi,

Is there a way to find the name of the process that has a file open? I know of tools, like
Unlocker, that can do it, so I assume there are some systemcalls that can help me out.

Thanks.

No there are no system calls or public API's available for this, tools like Unlocker and
tools from Sysinternals are just using some non documented ntdll API's and are inspecting
the handle tables of each individual process, this requires "debugging privileges" to be
granted to the "spying" application.

Willy.