Which files are opened by a specific application?

Question

Is there a way to list all files that are currently opened by a specific process in Windows?

I mean files that got have an fopen, but never got an fclose by a specific process.

I tried to use Sysinternals Process Monitor, but I couldn't figure out how to list the current opened files – but only when the opening happens.

Answer 1

You could try Sysinternals Process Explorer instead of Process Monitor. Process Monitor is design for watching what processes do as they do then. Process Explorer is more for seeing the current state of processes; it's Task Manager but with about 10x the functionality.

Sysinternals also have handle.exe which is a command line tool that tells you which files a process has open.

Answer 2

Check out Process Explorer from Sysinternals.

To see the open files for a process, select a process from the list, select the View->Lower Panel View->Handles menu option. All of the handles of type "File" are the open files.

Also, a great way to find which application has a file open is by using the Find->Handle or DLL menu option. Just enter the name of the file you are looking for and hit "Search" to find the processes with a file open matching the search string.

Answer 3

Process Explorer from Sysinternals is actually pretty useless when it comes to dealing with file handles (as opposed to DLL's, etc.). Use Windows Resource Monitor, click on CPU tab. Next to Associated Handles type the name of the file and you will see who has it open.

Answer 4

As Dave rightly said, use Process Explorer from SysInternals, apart from that they offer varying set of utils. Checkout: http://technet.microsoft.com/en-us/sysinternals/bb842062.aspx