Re: how to get files opened by a process

[Willy Denoyette [MVP]]

You can't find the files opened by a specific process, however it's possible
to get the process(es) that has a specific file open.
Here's a sample:

public static void Main() {
WhoHasThisFileOpen(@"c:\\filepath");
}

static void WhoHasThisFileOpen(string objectQry) {

SelectQuery query = new SelectQuery("select name from cim_datafile where
name ='" + objectQry +"'" );
using(ManagementObjectSearcher searcher = new
ManagementObjectSearcher(query)) {
foreach (ManagementObject mo in searcher.Get()) {
Console.WriteLine("File Name: {0} \nIs currently opened by:",
mo.Properties["Name"].Value);
// Get processes having this File open
foreach (ManagementBaseObject b in mo.GetRelated("Win32_Process")) {
ShowProcessProperties(b.ToString());
}
}
}
}
static void ShowProcessProperties(string objectClass) {
using(ManagementObject process = new ManagementObject (objectClass))
{
process.Get();
PropertyDataCollection processProperties = process.Properties;
Console.WriteLine("ProcessID: {0,6} \tCommandLine: {1}" ,
processProperties["ProcessID"].Value,
processProperties["CommandLine"].Value);
}
}
}

Willy.

 

[Guest]

Hi Willy,
Thank you for your quick answer.I have already seen your code sample in some
other discussions. However there are some problems with it. For example if
you call WhoHasThisFileOpen(@"c:\documents\test document.doc"), there is a
ManagementException, when "foreach (ManagementObject mo in searcher.Get())"
is reached, which says "Invalid query". Further I change the condition
"select name from cim_datafile where name ='" + objectQry +"'" to
"select name from cim_datafile where filename ='" +
Path.GetFileNameWithoutExtension(objectQry) +"'"
Now there is no exception, but mo.GetRelated("Win32_Process"), did not find
anything.
Furthermore I made the oposite of your sample, just for test. I start from
the process and get it's realated cim_datafile. It returns all modules used
by the process, the same as Process.Modules, which is not my case, I want to
get non executable files, e.g. "c:\documents\test document.doc" or
"c:\documents\test document.pdf".
So am I missing something or your sample is not correct and finds only
files, which are executables?
Here is my sample of the oposite
public static void EnumerateProccess()
{
SelectQuery query = new SelectQuery("select * from Win32_Process where
name = 'winword.exe'" );
using(ManagementObjectSearcher searcher = new
ManagementObjectSearcher(query))
{
try
{
if(searcher != null)
{
foreach (ManagementObject mo in searcher.Get())
{Console.WriteLine("Proccess Name: {0}", mo["Name"]);
// Get processes having this File open
foreach (ManagementObject b in mo.GetRelated("cim_datafile"))
{ b.Get();
PropertyDataCollection fileProperties = b.Properties;
Console.WriteLine("File Name: {0} " , fileProperties["Name"].Value);
b.Dispose();}
}
}
}
catch(Exception e)
{
Console.WriteLine(e.Message);
}
Console.WriteLine("Enumeration ended");
}
}

You can't find the files opened by a specific process, however it's possible
to get the process(es) that has a specific file open.
Here's a sample:

public static void Main() {
WhoHasThisFileOpen(@"c:\\filepath");
}

static void WhoHasThisFileOpen(string objectQry) {

SelectQuery query = new SelectQuery("select name from cim_datafile where
name ='" + objectQry +"'" );
using(ManagementObjectSearcher searcher = new
ManagementObjectSearcher(query)) {
foreach (ManagementObject mo in searcher.Get()) {
Console.WriteLine("File Name: {0} \nIs currently opened by:",
mo.Properties["Name"].Value);
// Get processes having this File open
foreach (ManagementBaseObject b in mo.GetRelated("Win32_Process")) {
ShowProcessProperties(b.ToString());
}
}
}
}
static void ShowProcessProperties(string objectClass) {
using(ManagementObject process = new ManagementObject (objectClass))
{
process.Get();
PropertyDataCollection processProperties = process.Properties;
Console.WriteLine("ProcessID: {0,6} \tCommandLine: {1}" ,
processProperties["ProcessID"].Value,
processProperties["CommandLine"].Value);
}
}
}

Willy.

Hi,
I have a difficulties with finding a way to see, what files a process
keeps
opened. I'm using C#.
For example if you track "winword" process, I want to see if it keeps open
a
file "c:\my documents\test.doc".
I read about WMI, but could not find a solution with it. I saw some tools
of
www.sysinternals.com, like "handle" and "process explorer", which are
doing
such monitoring.
Can you please help me?