tool to identify file usage

  • Thread starter Thread starter cactus
  • Start date Start date
C

cactus

Does anyone know of a tool that indicates which program or process is
using a specific file?

TIA
 
Would that include 'data' files, i.e., other that .exe, .dll,
etc.?
Click to expand...
Yes, it reports on _all_ files *currently* held open by the process.

Like /lsof/ in the UNIX world.

Cheers,
Gary B-)
 
Gary said:
Yes, it reports on _all_ files *currently* held open by the process.

Like /lsof/ in the UNIX world.
Click to expand...

It does? That would be nice. However, I'm using Millennium Editon and
right now have WordPerfect running with a document open that I created
the day before yesterday. I also have Process Explorer v.8.51 running,
but I can't find any listing of my document within it, although it
shows WP running. Can you tell me where to find the listing for the
document?

TIA

--
Regards from John Corliss
No adware, cdware, commercial software, crippleware, demoware,
nagware, shareware, spyware, time-limited software, trialware, viruses
or warez please.

Because Andy Mabbett is stalking me in this group, I have him killfiled.
 
On Sat, 09 Oct 2004 00:50:38 -0700, John Corliss wrote:

[Process Explorer]
It does? That would be nice. However, I'm using Millennium Editon and
right now have WordPerfect running with a document open that I created
the day before yesterday. I also have Process Explorer v.8.51 running,
but I can't find any listing of my document within it, although it
shows WP running. Can you tell me where to find the listing for the
document?
Click to expand...

<BG> Yes. The suggested Process Explorer is the wrong tool for this
task. Maybe you just put your critics into a smooth question? </BG>
FileMon is the tool the OP is after:

http://www.sysinternals.com/ntw2k/source/filemon.shtml

BeAr
 
John Corliss said:
It does? That would be nice. However, I'm using Millennium Editon and
right now have WordPerfect running with a document open that I created
the day before yesterday. I also have Process Explorer v.8.51 running,
but I can't find any listing of my document within it, although it
shows WP running. Can you tell me where to find the listing for the
document?
Click to expand...
Highlight WP in the top window and double-click, then look at the
Command line?
Works for Notepad anyway. It may run out of sight but can be brought
back into view with a little tickle.
 
Roger said:
John Corliss writes

Highlight WP in the top window and double-click, then look at the
Command line?
Works for Notepad anyway. It may run out of sight but can be brought
back into view with a little tickle.
Click to expand...

'Fraid that doesn't work in Process Explorer for WordPerfect at least.

--
Regards from John Corliss
No adware, cdware, commercial software, crippleware, demoware,
nagware, shareware, spyware, time-limited software, trialware, viruses
or warez please.

Because Andy Mabbett is stalking me in this group, I have him killfiled.
 
B. R. 'BeAr' Ederson said:
John Corliss wrote:

[Process Explorer]
It does? That would be nice. However, I'm using Millennium Editon and
right now have WordPerfect running with a document open that I created
the day before yesterday. I also have Process Explorer v.8.51 running,
but I can't find any listing of my document within it, although it
shows WP running. Can you tell me where to find the listing for the
document?
Click to expand...

<BG> Yes. The suggested Process Explorer is the wrong tool for this
task. Maybe you just put your critics into a smooth question? </BG>
Click to expand...

Nope. I really was serious that I wanted to know how to do this.
FileMon is the tool the OP is after:

http://www.sysinternals.com/ntw2k/source/filemon.shtml
Click to expand...

Thanks for pointing this one out. Downloading.

--
Regards from John Corliss
No adware, cdware, commercial software, crippleware, demoware,
nagware, shareware, spyware, time-limited software, trialware, viruses
or warez please.

Because Andy Mabbett is stalking me in this group, I have him killfiled.
 
John Corliss said:
'Fraid that doesn't work in Process Explorer for WordPerfect at least.
Click to expand...

To be sure it isn't listed somewhere you can use the Find -> Handle
option and type some part of the filename opened by WP.
 
John said:
It does? That would be nice. However, I'm using Millennium Editon and
right now have WordPerfect running with a document open that I created
the day before yesterday. I also have Process Explorer v.8.51 running,
but I can't find any listing of my document within it, although it shows
WP running. Can you tell me where to find the listing for the document?
Click to expand...
That's an easy one - WP usually doesn't hold a document's file open, so
procexp _can't_ report it as being open.

To elucidate:
WP opens the document file
WP reads the contents into memory, and possibly a temporary file
WP closes the document file

When you close the document, or when autosave happens:
WP opens the document file
WP writes out the file (or sometimes just the changes)
WP closes the file

Most text- and file-processing programs work in this manner.

Cheers,
Gary B-)
 
John Corliss wrote:
[SNIP]
It does? That would be nice. However, I'm using Millennium Editon and
right now have WordPerfect running with a document open that I created
the day before yesterday. I also have Process Explorer v.8.51 running,
but I can't find any listing of my document within it, although it shows
WP running. Can you tell me where to find the listing for the document?
Click to expand...

Dammit it's filemon, as soemone else pointed out!

I plead weekend-itis!!

Cheers,
Gary B-)
 
John Corliss said:
Thanks for pointing this one out. Downloading.
Click to expand...

I couldn't survive without Filemon.

(One of the activities where it regularly comes into service for me,
its from my moving around programs, and their dependencies, which I
do constantly -- and occasionally one of them will start to complain,
so I then use Filemon to find out what they want, what they use.)

Warning. Just like Regmon, focus seriously on your filters. Else you
could land into one of those crazed 5meg-per-minute logs.

Second Warning. Unless this had been fixed in a recent release(?) It
always opens with its window On-Top and Full-Screen. So every launch,
you have to deal with that. (I need access to another window when I
run it. Because getting a useful log involves rapid timing, carefully
poised trigger finger, between the target action and the Filemon "Start
logging" command.)
 
On Sat, 9 Oct 2004 09:58:34 +0100, Roger Hunt wrote:

[Process Explorer]
Highlight WP in the top window and double-click, then look at the
Command line?
Works for Notepad anyway. It may run out of sight but can be brought
back into view with a little tickle.
Click to expand...

The command line view is exactly what it sounds like. Nothing more or
less. It shows if the program has been started with a preselected file
to open. That's always the case if you're double clicking on a document
within Explorer (or another shell). Other methods of execution grant
you still more possibilities to include more options. (Like a /r switch
to open a file read only, for instance.)

It is praxis since the old days of DOS that the command line (with which
a program has been started) is stored inside the environment of the
program (a special branch of memory which the program gets on execution).
That's the position which Process Explorer reads.

Any file opened later (via file->open or such methods) is out of scope
for Process Explorer. The only exception is if the program holds a
document file open all the time. Then (and only with the newest version
of Process Explorer) you are able to see this document, too.

BeAr
 
B. R. 'BeAr' said:
On Sat, 9 Oct 2004 09:58:34 +0100, Roger Hunt wrote:

[Process Explorer]
Highlight WP in the top window and double-click, then look at the
Command line?
Works for Notepad anyway. It may run out of sight but can be brought
back into view with a little tickle.
Click to expand...

The command line view is exactly what it sounds like. Nothing more or
less. It shows if the program has been started with a preselected file
to open. That's always the case if you're double clicking on a document
within Explorer (or another shell). Other methods of execution grant
you still more possibilities to include more options. (Like a /r switch
to open a file read only, for instance.)

It is praxis since the old days of DOS that the command line (with which
a program has been started) is stored inside the environment of the
program (a special branch of memory which the program gets on execution).
That's the position which Process Explorer reads.

Any file opened later (via file->open or such methods) is out of scope
for Process Explorer. The only exception is if the program holds a
document file open all the time. Then (and only with the newest version
of Process Explorer) you are able to see this document, too.
Click to expand...
Thanks for that - quite an interesting thread this is. :-)
(I shall go practice with Filemon filters)
 
omega said:
I couldn't survive without Filemon.

(One of the activities where it regularly comes into service for me,
its from my moving around programs, and their dependencies, which I
do constantly -- and occasionally one of them will start to complain,
so I then use Filemon to find out what they want, what they use.)

Warning. Just like Regmon, focus seriously on your filters. Else you
could land into one of those crazed 5meg-per-minute logs.
Click to expand...
(snip)

5 meg a minute? That's nothing! Try gl_log with Quake2. 516MB in one
minute here.
That's one scary big log file. :-)
 
Gert said:
To be sure it isn't listed somewhere you can use the Find -> Handle
option and type some part of the filename opened by WP.
Click to expand...

Didn't work. Anyway, if I don't know what files a progam has open, how
could I search for them using this method?

--
Regards from John Corliss
No adware, cdware, commercial software, crippleware, demoware,
nagware, shareware, spyware, time-limited software, trialware, viruses
or warez please.

Because Andy Mabbett is stalking me in this group, I have him killfiled.
 
Gary said:
That's an easy one - WP usually doesn't hold a document's file open, so
procexp _can't_ report it as being open.

To elucidate:
WP opens the document file
WP reads the contents into memory, and possibly a temporary file
WP closes the document file

When you close the document, or when autosave happens:
WP opens the document file
WP writes out the file (or sometimes just the changes)
WP closes the file

Most text- and file-processing programs work in this manner.
Click to expand...

Well I'll be hornswoggled. Learn something every day. On the other
hand, this means that Process Explorer's cabability to indicate open
files would be worthless.

--
Regards from John Corliss
No adware, cdware, commercial software, crippleware, demoware,
nagware, shareware, spyware, time-limited software, trialware, viruses
or warez please.

Because Andy Mabbett is stalking me in this group, I have him killfiled.
 
John said:
Didn't work. Anyway, if I don't know what files a progam has open, how
could I search for them using this method?>
Click to expand...

Process Explorer can show you all files that a process currently has
open. Select the process in the main window, and hit Ctrl + L (or select
View -> Lower Pane View -> Handles from the main menu).

In the lower pane that is now open, click on the 'Type' column header to
sort by type. Each entry for the type 'File' displays the name and full
path of a file currently opened by the process.

Of course, this method won't work if the process (WordPerfect, in this
case) doesn't keep the file open all the time that it is running. For
example, it may open the file when it starts up, load it into memory,
and then close the file. To capture this type of file access, FileMon is
recommended.
 
Back
Top