Check file is locked?

[Tim Golden]

Rajat wrote:
> The Notepad process information is fine here. However, with wordpad
> the results are not much differentiating:
> 
> ------------------------------------------------------------------------------
> wordpad.exe pid: 2832 COMP\rajatd
>    1C: File  (RW-)   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-
> Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
>    40: File  (RW-)   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-
> Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
>    74: Section       \BaseNamedObjects\ShimSharedMemory
>    F8: Section       \BaseNamedObjects
> \CiceroSharedMemDefaultS-1-5-21-57989841-1580818891-839522115-1653
>   170: Section       \BaseNamedObjects\RotHintTable
>   184: File  (RW-)   C:\Documents and Settings\rajatd\My Documents
> ------------------------------------------------------------------------------
> wordpad.exe pid: 844 COMP\rajatd
>    1C: File  (RW-)   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-
> Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
>    40: File  (RW-)   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-
> Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
>    74: Section       \BaseNamedObjects\ShimSharedMemory
>    F8: Section       \BaseNamedObjects
> \CiceroSharedMemDefaultS-1-5-21-57989841-1580818891-839522115-1653
>   170: Section       \BaseNamedObjects\RotHintTable
>   184: File  (RW-)   C:\Documents and Settings\rajatd\My Documents
> 
> Both the wordpad applications opened 2 totally different files kept at
> different locations on the system.
> 
> So, on the basis of above results one can not say out of these 2
> wordpad apps which is the right one that could be closed. The only
> different thing among the two is the PIDs.


Rajat: are you trying to find out which app is holding a file open?

If so -- run handle.exe *for that filename*, as my code does:

handle.exe <filename>

This will only show which apps are holding that file. I suspect
you're running handle.exe on its own which will show everything
which is holding handles on anything.

1) Use wordpad.exe to open c:\temp\blah.txt

2) Run "handle.exe c:\temp\blah.txt"

3) Observe (at least on my Win XP Sp3 machine) that *no* process
has a handle open on c:\temp\blah.txt, including wordpad, which
presumably opens the file, reads it, and closes it again.


The items you're seeing above are system-level handles which
wordpad is holding for reasons of its own, but none of them
is a user filename.

TJG