Sunday, September 10, 2017

How to determine what files are being locked/read/written by a process in Windows?


  1. In Windows if I want to check what process is using a file I can use programs such as Process Hacker and its search function to type the name of that file.


    From the information it provides I know a process is doing something with that file but I don't know if it locked it, or if it's just reading it or writing on it. How can I get that information?


  2. More important, what about the opposite?
    I want to find the name of the files being locked or written or read by a process.


    How can I do it?



In the following screenshot you can see how easy is to find the process name from the file name, but how can I find the name of the files used by a given process?


enter image description here


In this example I'm using Acrobat to open a PDF file called eemeir.pdf, but this doens't get listed on the Acrobat process tree.


With Process Explorer is the same:


enter image description here


PD:
@user173724 suggested how to do it using Process Explorer, and I've also found how to do it with PH:


I need to select the option “View -> Window” and a very large list of information appear.


But it's very ugly and not comfortable to find anything there (the same goes for Process Explorer), it doesn't have a search function in this section.


Also Right+clicking on a “Process -> Properties -> Handles.”

No comments:

Post a Comment

hard drive - Leaving bad sectors in unformatted partition?

Laptop was acting really weird, and copy and seek times were really slow, so I decided to scan the hard drive surface. I have a couple hundr...