<p>One of my favourite tools for linux is <a href="http://en.wikipedia.org/wiki/Lsof" rel="noreferrer" title="Wikipedia">lsof</a> - a real swiss army knife!</p>

<p>Today I found myself wondering which programs on a WinXP system had a specific file open. Is there any equivalent utility to lsof? Additionally, the file in question was over a network share so I'm not sure if that complicates matters.</p>

[{'answer_id': 15713, 'author': 'Matt Hamilton', 'author_id': 615, 'author_profile': 'https://Stackoverflow.com/users/615', 'pm_score': 2, 'selected': False, 'text': '<p>If you right-click on your "Computer" (or "My Computer") icon and select "Manage" from the pop-up menu, that\'ll take you to the Computer Management console.</p>\n\n<p>In there, under System Tools\\Shared Folders, you\'ll find "Open Files". This is probably close to what you want, but if the file is on a network share then you\'d need to do the same thing on the server on which the file lives.</p>\n'}, {'answer_id': 15719, 'author': 'slipsec', 'author_id': 1635, 'author_profile': 'https://Stackoverflow.com/users/1635', 'pm_score': 4, 'selected': False, 'text': '<p>Try <a href="http://technet.microsoft.com/en-us/sysinternals/bb896655.aspx" rel="noreferrer">Handle</a>.  <a href="http://technet.microsoft.com/en-us/sysinternals/bb896642.aspx" rel="noreferrer">Filemon</a> &amp; <a href="http://technet.microsoft.com/en-us/sysinternals/bb896652.aspx" rel="noreferrer">Regmon</a> are also great for trying to figure out what the duce program foo is doing to your system.</p>\n'}, {'answer_id': 15722, 'author': 'Jay Hofacker', 'author_id': 535, 'author_profile': 'https://Stackoverflow.com/users/535', 'pm_score': 7, 'selected': True, 'text': '<p>Use <a href="http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx" rel="noreferrer" title="Process Explorer">Process Explorer</a> from the Sysinternals Suite, the Find Handle or DLL function will let you search for the process with that file open.</p>\n'}, {'answer_id': 188337, 'author': 'Greg Mattes', 'author_id': 13940, 'author_profile': 'https://Stackoverflow.com/users/13940', 'pm_score': 3, 'selected': False, 'text': '<p>Try <a href="http://www.emptyloop.com/unlocker/" rel="noreferrer">Unlocker</a>.</p>\n\n<p>The Unlocker site has a nifty chart (scroll down after following the link) that shows a comparison to other tools. Obviously such comparisons are usually biased since they are typically written by the tool author, but the chart at least lists the alternatives so that you can try them for yourself.</p>\n'}, {'answer_id': 599268, 'author': 'Community', 'author_id': -1, 'author_profile': 'https://Stackoverflow.com/users/-1', 'pm_score': 6, 'selected': False, 'text': '<p>The equivalent of <code>lsof -p pid</code> is the combined output from sysinternals handle and listdlls, ie</p>\n\n<pre><code>handle -p pid\nlistdlls -p pid\n</code></pre>\n\n<p>you can find out pid with sysinternals <code>pslist</code>.</p>\n'}, {'answer_id': 731125, 'author': 'Sean', 'author_id': 26095, 'author_profile': 'https://Stackoverflow.com/users/26095', 'pm_score': 3, 'selected': False, 'text': '<p>If the file is a .dll then you can use the <strong>TaskList</strong> command line app to see whose got it open:</p>\n\n<pre><code>TaskList /M nameof.dll\n</code></pre>\n'}, {'answer_id': 2425344, 'author': 'pushNpop', 'author_id': 291090, 'author_profile': 'https://Stackoverflow.com/users/291090', 'pm_score': 2, 'selected': False, 'text': '<p>Use Process Explorer to find the process id. Then use <a href="http://technet.microsoft.com/en-us/sysinternals/bb896655.aspx" rel="nofollow noreferrer">Handle</a> to find out what files are open. </p>\n\n<p>Eg handle -p </p>\n\n<p>I like this approach because you are using utilities from Microsoft itself.</p>\n'}, {'answer_id': 8294386, 'author': 'M8R-qpgep8', 'author_id': 1069132, 'author_profile': 'https://Stackoverflow.com/users/1069132', 'pm_score': 2, 'selected': False, 'text': '<p>In <a href="http://www.nirsoft.net/utils/opened_files_view.html" rel="nofollow">OpenedFilesView</a>, under the Options menu, there is a menu item named "Show Network Files".  Perhaps with that enabled, the aforementioned utility is of some use.</p>\n'}, {'answer_id': 9802841, 'author': 'Alois Mahdal', 'author_id': 835945, 'author_profile': 'https://Stackoverflow.com/users/835945', 'pm_score': 3, 'selected': False, 'text': '<p>One equivalent of <em>lsof</em> could be combined output from Sysinternals\' <em>handle</em> and <em>listdlls</em>, i.e.:</p>\n\n<pre><code>c:\\SysInternals&gt;handle\n[...]\n------------------------------------------------------------------------------\ngvim.exe pid: 5380 FOO\\alois.mahdal\n   10: File  (RW-)   C:\\Windows\n   1C: File  (RW-)   D:\\some\\locked\\path\\OpenFile.txt\n[...]\n\nc:\\SysInternals&gt;listdlls\n[...]\n------------------------------------------------------------------------------\nListdlls.exe pid: 6840\nCommand line: listdlls\n\n  Base        Size      Version         Path\n  0x00400000  0x29000   2.25.0000.0000  D:\\opt\\SysinternalsSuite\\Listdlls.exe\n  0x76ed0000  0x180000  6.01.7601.17725  C:\\Windows\\SysWOW64\\ntdll.dll\n[...]\n\nc:\\SysInternals&gt;listdlls\n</code></pre>\n\n<p>Unfortunately, you have to "run as Administrator" to be able to  use them.</p>\n\n<p>Also <em>listdlls</em> and <em>handle</em> do not produce continuous table-like form so filtering filename would hide PID. <code>findstr /c:pid: /c:&lt;filename&gt;</code> should get you very close with both utilities, though</p>\n\n<pre><code>c:\\SysinternalsSuite&gt;handle | findstr /c:pid: /c:Driver.pm\nSystem pid: 4 \\&lt;unable to open process&gt;\nsmss.exe pid: 308 NT AUTHORITY\\SYSTEM\navgrsa.exe pid: 384 NT AUTHORITY\\SYSTEM\n[...]\ncmd.exe pid: 7140 FOO\\alois.mahdal\nconhost.exe pid: 1212 FOO\\alois.mahdal\ngvim.exe pid: 3408 FOO\\alois.mahdal\n  188: File  (RW-)   D:\\some\\locked\\path\\OpenFile.txt\ntaskmgr.exe pid: 6016 FOO\\alois.mahdal\n[...]\n</code></pre>\n\n<p>Here we can see that gvim.exe is the one having this file open.</p>\n'}, {'answer_id': 10519174, 'author': 'anonymous', 'author_id': 1385006, 'author_profile': 'https://Stackoverflow.com/users/1385006', 'pm_score': 2, 'selected': False, 'text': '<p>There is a program "OpenFiles", seems to be part of windows 7. Seems that it can do what you want. It can list files opened by remote users (through file share) and, after calling \n"openfiles /Local on" and a system restart, it should be able to show files opened locally. The latter is said to have performance penalties.</p>\n'}]
['https://Stackoverflow.com/questions/15708', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/1848/']