When I try to delete a file it can sometimes be open in another program.
How do I detect which program has my file opened and how do I close their handle to my program to allow me to delete my file?
You can use Sysinternals suite's ProcExp.
download from here.
CTRL+F to search for the file handle..and right click + close handle to close it.
make sure to run ProcExp as an Administrator!
If in Linux or on a Mac, use lsof. It can be used to show open files, open sockets, and more - I often use it for network stuff, instead of netstat.
Related
I'm opening a file for a video I'm creating and writing to disk with fopen in C++, I'm able to write to disk. But when I try to read it as I'm writing it, it will throw errors saying that it doesn't have permission to read the file as soon as I close the file or stop the program, I can suddenly read from it.
Not an issue with not finishing writing the write as if I crash the program, can still read it. Also, VLC's logs tell me it's a permission issue.
Any idea how to change that permission?
Response to William asking for code snippets or if open happened before the file existed:
Thanks William, here's what I've got. I waited a few minutes and could see the file with windows explorer by that point and waited until after I'd flushed and data was there, couldn't open with VLC or Notepad++ or Notepad or Windows Media Player
Notepad says cannot access because it is being used by another process, others too.
Here is the VLC log while it tries to open this:
http://snippi.com/s/g4cbu23
Here is where I create the file with fopen:
http://snippi.com/s/cyajw4h
At the very end is where I write to the file using fwrite and flush:
http://snippi.com/s/oz27m0g
You need to use _fsopen with _SH_DENYNO if you want the file to be shareable.
Read a file using a program like Notepad while the file is being written to by another program?
I've created a Windows Service application that logs continuously.
I want to inspect the current events of the service without closing it. To do this I open the log.txt in Notepad, but gets the message
The process cannot access the file because it is being used by another
process
How can I read the log file without closing the service? After the service is closed, I can readily inspect every log entry in the file.
The file is being written by calls to fopen_s and fprintf, if that should be of any interest. Also, the service is programmed in C/C++ on Windows 10 64-bit, running under SCM with default priviledges i.e. LocalSystem.
https://msdn.microsoft.com/en-us/library/z5hh6ee9.aspx and then Remarks:
Files that are opened by fopen_s and _wfopen_s are not sharable. If you require that a file be sharable, use _fsopen, _wfsopen with the appropriate sharing mode constant—for example, _SH_DENYNO for read/write sharing.
Would that be a solution?
How to know the process that blocked a file in windows, e.g.: when trying to delete a file that is in use, how to know the process that using that file?
Use Microsoft/Sysinternal's ProcessMonitor. Used to be file FileMon but I think everything is merged in ProcessMonitor now.
I had faced the same issue. I use Process Explorer for this. This is free and is like a task manager tool with advanced features.
Just press Ctrl+F or select Find and type the full or part name of the file or drive you're looking for. Select the file from the search result. This will take you to the bottom part of the window showing the file and the process which is keeping it open.
Just right click and select Close Handle. It will ask for yes / no, select yes and you're done. This tool can also be used if you're unable to safely remove a pen-drive or similar hardware. Just search for the drive letter (eg. G:) and close all the open handles.
Please ensure that you don't mis-use this tool to close handles to
system files, sabotage a system or cause harm to someone.
Hope this helps!
Vivek
i want to make a program which block any file(like autorun.inf),so that no other program can read from it(just like a way,antivirus do) with c++ in windows.
please help me.
thanks.
You can open a file with a dwShareMode of 0, which will
Prevents other processes from opening a file or device if they request delete, read, or write access.
So once your process opens the file, no other process will be able to open it, delete it, etc.
MSDN Reference
either set the NTFS ACLs on the file
or
use CreateFile() to open the file with dwShareMode=0 http://msdn.microsoft.com/en-us/library/aa363858(v=vs.85).aspx
You could encrypt the file. If it's unreadable it's unusable!
A simple xor will do.
I'm trying to make a small program that could intercept the open process of a file.
The purpose is when an user double-click on a file in a given folder, windows would inform to the software, then it process that petition and return windows the data of the file.
Maybe there would be another solution like monitoring Open messages and force Windows to wait while the program prepare the contents of the file.
One application of this concept, could be to manage desencryption of a file in a transparent way to the user.
In this context, the encrypted file would be on the disk and when the user open it ( with double-click on it or with some application such as notepad ), the background process would intercept that open event, desencrypt the file and give the contents of that file to the asking application.
It's a little bit strange concept, it could be like "Man In The Middle" network concept, but with files instead of network packets.
Thanks for reading.
The best way to do it to cover all cases of opening from any program would be via a file system filter driver. This may be too complex for your needs though.
You can use the trick that Process Explorer uses to replace itself with task manager. Basically create a key like this:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
Where you replace 'taskmgr.exe' with the name of the process to intercept. Then add a string value called 'Debugger' that has the path to your executable. E.g:
Debugger -> "C:\windows\system32\notepad.exe"
Every a process is run that matches the image name your process will actually be called as a debugger for that process with the path to the actual process as an argument.
You could use code injection and API redirection. You'd start your target process and then inject a DLL which hooks the windows API functions that you want to intercept. You then get called when the target process thinks it's calling OpenFile() or whatever and you can do what you like before passing the call on to the real API.
Google for "IAT hooking".
Windows has an option to encrypt files on the disk (file->properties->advanced->encrypt) and this option is completely transparent to the applications.
Maybe to encrypt decrypt file portions of a disk you should consider softwares like criptainer?
There is this software as well http://www.truecrypt.org/downloads (free and open source) but I haven't tried it.
Developing a custom solution sounds very difficult.