[aesopfables]

Hi All,

Just wondering if anyone could help getting the process and the file handles currently opened by Windows.
I've found alot of stuff on the filesystemwatch, but i dont want to monitor a single object, is there anything native that could help achieve the same output and list all the process with file handles open?

Thanks you in advance

:)

[MavenGradle]

Sure there is. The Restart Manager might come in handy for your purposes.

More specifically, the RmGetList function:
https://docs.microsoft.com/en-us/windows...-rmgetlist

Or the more refined approach; You can use NtQueryInformationFile and look for the FILE_PROCESS_IDS_USING_FILE_INFORMATION struct:
https://docs.microsoft.com/en-us/windows...dfrom=MSDN
https://docs.microsoft.com/en-us/windows...dfrom=MSDN

[aesopfables]

Thanks Mate! Exactly the sort of sample i was after.
I was looking at getting filehandles help by a process, so this pointed me in the right direction.
Thank you

[MavenGradle]

Thanks Mate! Exactly the sort of sample i was after.
I was looking at getting filehandles help by a process, so this pointed me in the right direction.
Thank you

Good to hear. Feel free to post any and all interesting questions you may have in this section if you require further assistance.
It certainly won't harm the quality of the subsection seeing more of these, as most of them are related to skidware anyway.

[aesopfables]

Thanks Maven! i found a solution using the NtQueryInformationFile method.
I was able to list all the file handles opened/closed by procecss. Will post Source but it C++ and not C#
but can easily be written.

thanks again, i got alot more of "these" sort question over skid q, read read and you shall understand.

---

Thanks Maven found i can get the info from both Restart Manager and NtQueryInformationFile.
Found a good C++ example i'll rewrite but thanks again for pointing me in the right direction :)