Which process opened a file?
-
Hi all, could you give me a little hint how to get a name of process which opened file? example: I have a file C:\temp\test.txt - I need to know which process opened this file. Thanks.
You can use NtQuerySystemInformation() and pass 'SystemHandleInformation' as the SYSTEM_INFORMATION_CLASS. You will need to iterate through the returned buffer and locate the handle and match it with the process ID. http://msdn2.microsoft.com/en-us/library/ms724509.aspx[^] http://www.codeguru.com/Cpp/W-P/system/processesmodules/article.php/c2827[^] Best Wishes, -David Delaune
-
Hi all, could you give me a little hint how to get a name of process which opened file? example: I have a file C:\temp\test.txt - I need to know which process opened this file. Thanks.
Do you want a utility to do this or know how to code it yourself? SysInternals have utilities that can tell you this information.
Steve
-
Hi all, could you give me a little hint how to get a name of process which opened file? example: I have a file C:\temp\test.txt - I need to know which process opened this file. Thanks.
Did you need to this code?
DWORD m_Return=GetModuleFileNameEx(hProcess, hModuleHandle, str1, sizeof(str1) );