Open files and locks

[Mark]

Is there a way in the dotnet to determine what files have locks and then
what process is locking the file?

[phoenix]

I'm afraid you'll have to p/invoke ntdll.dll to get what you want.

Yves

"Mark" <no************@technologist.com> schreef in bericht
news:%2****************@TK2MSFTNGP12.phx.gbl...

Is there a way in the dotnet to determine what files have locks and then
what process is locking the file?

[Jeffrey Tan[MSFT]]

Hi Mark,

Thank you for posting in the community!

Based on my understanding, you want to determine if one file is locked by
another process, and which process locked this file.

=============================================
For your first part concern, you can use exception to get this done:
Use you .Net application to access this file, if this file is locked, then
an exception will generate, in the exception handler, you can determine
that this file is locked by another process.

For your second part concern, .Net did not expose this function for users.
Actually, event in win32 environment, there are not a documented way to get
this information.
You may use some undocumented Windows 2000/NT native API to get this done.
These APIs are included in ntdll.dll.
In .Net, you can use P/invoke to use them.

For more information, please refer to:
http://groups.google.com/groups?hl=e...ame=right&th=d
392ffdb818c5665&seekm=vL7bp2axCHA.3256%40cpmsftngx a06#link1

Also, the below article "Inside the Native API" may give you more
information on native api:
http://www.sysinternals.com/ntw2k/info/ntdll.shtml

There is a "Process Explorer" tool in sysinternals website, it may help
you, please refer to:
http://www.sysinternals.com/ntw2k/fr.../procexp.shtml

===========================================
Please apply my suggestion above and let me know if it helps resolve your
problem.

Thank you for your patience and cooperation. If you have any questions or
concerns, please feel free to post it in the group. I am standing by to be
of assistance.
Have a nice day!!

Best regards,
Jeffrey Tan
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

[Jeffrey Tan[MSFT]]

Hi Mark,

Does my reply make sense to you?

If you still have any concern, please feel free to feedback, I will help
you.

Best regards,
Jeffrey Tan
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

[Mark]

Thank you for the response. First, if a file has a lock and throws an
exception that tells me its locked but not who is locking it. It seems
that I will need to look into pinvoke.

""Jeffrey Tan[MSFT]"" <v-*****@online.microsoft.com> wrote in message
news:Ht**************@cpmsftngxa07.phx.gbl...

Hi Mark,

Does my reply make sense to you?

If you still have any concern, please feel free to feedback, I will help
you.

Best regards,
Jeffrey Tan
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

[Willy Denoyette [MVP]]

"Mark" <no************@technologist.com> wrote in message
news:u4**************@TK2MSFTNGP10.phx.gbl...

Thank you for the response. First, if a file has a lock and throws an
exception that tells me its locked but not who is locking it. It seems
that I will need to look into pinvoke.

Not necessarily, you can use System.Management and WMI to query the
Processes associated with a file. Here's a sample to get you started.

Willy.

using System;
using System.Management;
// File - process relation query
class App {
public static void Main() {
ShowHDproperties(@"select * from cim_datafile where name=
'c:\\windows\\system32\\wsock32.dll'");
}

static void ShowHDproperties(string objectQry) {

SelectQuery query = new SelectQuery(objectQry);
ManagementObjectSearcher searcher = new ManagementObjectSearcher(query);
foreach (ManagementObject mo in searcher.Get()) {
PropertyDataCollection oProperties = mo.Properties;
foreach (PropertyData prop in oProperties ) {
if(hdProperty.Value !=null) // Show only non-null property values
Console.WriteLine("Property = {0}\t Value = {1}",
prop.Name, prop.Value);
}
// Get related processes
foreach (ManagementBaseObject b in mo.GetRelated("Win32_Process")) {
Console.WriteLine("--------------- File opened by
(Processes) -----------------");
ShowHDassocProperties(b.ToString());
b.Dispose();
}

}
}
static void ShowHDassocProperties(string objectClass) {
ManagementObject hd;
using(hd = new ManagementObject (objectClass))
{
hd.Get();
PropertyDataCollection hdProperties = hd.Properties;
Console.WriteLine("Commandline: {0} ProcessID: {1}"
,hdProperties["CommandLine"].Value, hdProperties["ProcessID"].Value);

}
}
}

[Willy Denoyette [MVP]]

Ignore the sample in my previous reply, here's a complete and working
sample.

using System;
using System.Management;
// Search the processes which have a certain file open
class App {
public static void Main() {
WhoHasThisFileOpen(@"c:\\windows\\system32\\wsock3 2.dll");
}
static void WhoHasThisFileOpen(string objectQry) {
SelectQuery query = new SelectQuery("select name from cim_datafile where
name ='" + objectQry +"'" );
using(ManagementObjectSearcher searcher = new
ManagementObjectSearcher(query)) {
foreach (ManagementObject mo in searcher.Get()) {
Console.WriteLine("File Name: {0} \nIs currently opened by:",
mo.Properties["Name"].Value);
// Get processes having this File open
foreach (ManagementBaseObject b in mo.GetRelated("Win32_Process")) {
ShowProcessProperties(b.ToString());
b.Dispose();
}
}
}
}
static void ShowProcessProperties(string objectClass) {
using(ManagementObject process = new ManagementObject (objectClass))
{
process.Get();
PropertyDataCollection processProperties = process.Properties;
Console.WriteLine("ProcessID: {0,6} \tCommandLine: {1}" ,
processProperties["ProcessID"].Value,
processProperties["CommandLine"].Value);
}
}
}

Willy.

[Mark]

I tried this on my Windows XP machine with VS 2003 Ent and it does not find
anything!

"Willy Denoyette [MVP]" <wi*************@pandora.be> wrote in message
news:eE**************@TK2MSFTNGP10.phx.gbl...

Ignore the sample in my previous reply, here's a complete and working
sample.

using System;
using System.Management;
// Search the processes which have a certain file open
class App {
public static void Main() {
WhoHasThisFileOpen(@"c:\\windows\\system32\\wsock3 2.dll");
}
static void WhoHasThisFileOpen(string objectQry) {
SelectQuery query = new SelectQuery("select name from cim_datafile where
name ='" + objectQry +"'" );
using(ManagementObjectSearcher searcher = new
ManagementObjectSearcher(query)) {
foreach (ManagementObject mo in searcher.Get()) {
Console.WriteLine("File Name: {0} \nIs currently opened by:",
mo.Properties["Name"].Value);
// Get processes having this File open
foreach (ManagementBaseObject b in mo.GetRelated("Win32_Process")) {
ShowProcessProperties(b.ToString());
b.Dispose();
}
}
}
}
static void ShowProcessProperties(string objectClass) {
using(ManagementObject process = new ManagementObject (objectClass))
{
process.Get();
PropertyDataCollection processProperties = process.Properties;
Console.WriteLine("ProcessID: {0,6} \tCommandLine: {1}" ,
processProperties["ProcessID"].Value,
processProperties["CommandLine"].Value);
}
}
}

Willy.

[Willy Denoyette [MVP]]

What file path did you use?

Willy.
"Mark" <no************@technologist.com> wrote in message
news:eA*************@tk2msftngp13.phx.gbl...

I tried this on my Windows XP machine with VS 2003 Ent and it does not find
anything!

[Jeffrey Tan[MSFT]]

Hi Mark,

Yes, I have tried Willy's sample code, it should work well.

I also use WinXP and Visual Studio.Net 2003 Architecture Enterprise
version.

In Willy's sample code, he use wsock32.dll as the parameter. I think your
wsock32.dll may not in the path "c:\\windows\\system32", you may check it
is a correctly path.

Also, you can debug into the code to see where is the problem.

Anyway, if you have further concern, please feel free to feedback.

Best regards,
Jeffrey Tan
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

[Willy Denoyette [MVP]]

Jeffey,
In general this works as expected, of course there are constraints like the
callers token privileges, and the DACL put on the File objects, it's also
possible that a file is attached to a kernel subsystem, in which case this
won't work.

Willy.

"""Jeffrey Tan[MSFT]""" <v-*****@online.microsoft.com> wrote in message
news:iv**************@cpmsftngxa07.phx.gbl...

Hi Mark,

Yes, I have tried Willy's sample code, it should work well.

I also use WinXP and Visual Studio.Net 2003 Architecture Enterprise
version.

In Willy's sample code, he use wsock32.dll as the parameter. I think your
wsock32.dll may not in the path "c:\\windows\\system32", you may check it
is a correctly path.

Also, you can debug into the code to see where is the problem.

Anyway, if you have further concern, please feel free to feedback.

Best regards,
Jeffrey Tan
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

[Jeffrey Tan[MSFT]]

Hi Willy,

Yes, there can be many possibilities. Your information is very useful for
the community.

Thanks for your contribute!

Anyway, let's wait the feedback from Mark.

Best regards,
Jeffrey Tan
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

[Mark]

I was on vacation so I will check it again this week. It seems to me that
there must be some open file event I can hook into to see if a file is
opened similar to a virus scanner.

"""Jeffrey Tan[MSFT]""" <v-*****@online.microsoft.com> wrote in message
news:n3**************@cpmsftngxa07.phx.gbl...

Hi Willy,

Yes, there can be many possibilities. Your information is very useful for
the community.

Thanks for your contribute!

Anyway, let's wait the feedback from Mark.

Best regards,
Jeffrey Tan
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

[Jeffrey Tan[MSFT]]

Hi Mark,

Thanks very much for your feedback.

.Net does not expose this open file event feature. Because .Net
FileSystemWatcher class actually encapsulate the Win32 API
ReadDirectoryChangesW(), there is a 1:1 relationship between them. So the
FileSystemWatcher class can only provide the function that
ReadDirectoryChangesW() expose. If you look into the ReadDirectoryChangesW
function, you will see that it does not expose the function to monitor the
open file notification. So FileSystemWatcher does not expose this event
also.

Anyway, I will wait for your further feedback of the WMI solution. Thanks

Best regards,
Jeffrey Tan
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

[Mark]

I got the sample to work. It was looking for the operating system in
c:\windows when it was in c:\winnt.

The sample makes the assumption that I know what files I want to check. I
don't. I need to find the open files. You mentioned earlier that I could
use pinvoke on the ntdll.dll. Where would I find was functions to import
that are in ntdll.dll.

"""Jeffrey Tan[MSFT]""" <v-*****@online.microsoft.com> wrote in message
news:Oi***************@cpmsftngxa06.phx.gbl...

Hi Mark,

Thanks very much for your feedback.

Net does not expose this open file event feature. Because .Net
FileSystemWatcher class actually encapsulate the Win32 API
ReadDirectoryChangesW(), there is a 1:1 relationship between them. So the
FileSystemWatcher class can only provide the function that
ReadDirectoryChangesW() expose. If you look into the ReadDirectoryChangesW
function, you will see that it does not expose the function to monitor the
open file notification. So FileSystemWatcher does not expose this event
also.

Anyway, I will wait for your further feedback of the WMI solution. Thanks

Best regards,
Jeffrey Tan
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

[Jeffrey Tan[MSFT]]

Hi Mark,

Sorry for letting you wait for so long time.

Just as I stated in original reply, the functions in ntdll.dll are not
public documented, so I can not provide you the official document. But in
that reply, I have provided you some links which documented some of these
APIs in a non-official way. You may use it for your information.

I think the WMI way is a more suitable way of getting this done. As I see
that your concern is you want to know which files are locked. Actually, I
think the more realistic thing you want to do is getting all the files in a
certain directory that are opened. (Because all the files are opened in the
system is too large an amount)
To get this done, I think you may loop through all the files in that
directory, then for each file, use WMI to query the locked processes.

Does this meet your need? If you still have any concern, please feel free
to feedback.

Best regards,
Jeffrey Tan
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

[Jeffrey Tan[MSFT]]

Hi Mark,

Addtionally, to loop through the directory in .Net, please refer to
DirectoryInfo class in MSDN

Best regards,
Jeffrey Tan
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

[Jeffrey Tan[MSFT]]

Hi Mark,

Does my reply make sense to you ?

If you still have anything unclear, please feel free to tell me.

Best regards,
Jeffrey Tan
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

[Mark]

Its clear and I can find out if the file is locked but not who locked it.

"""Jeffrey Tan[MSFT]""" <v-*****@online.microsoft.com> wrote in message
news:mZ****************@cpmsftngxa06.phx.gbl...

Hi Mark,

Does my reply make sense to you ?

If you still have anything unclear, please feel free to tell me.

Best regards,
Jeffrey Tan
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

[Jeffrey Tan[MSFT]]

Hi Mark,

Sorry, I am not quite understand your meanning.

As you said, you can find out if the file is locked. So I think you can use
Willy's solution through WMI to get which processes locked this file.

Why did you say "but not who locked it."? Do you still haven concern ?

Best regards,
Jeffrey Tan
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

[Willy Denoyette [MVP]]

Mark,

What exactly do you mean with 'who locked it''?

Willy.

"Mark" <no************@technologist.com> wrote in message
news:ut**************@TK2MSFTNGP09.phx.gbl...

Its clear and I can find out if the file is locked but not who locked it.

"""Jeffrey Tan[MSFT]""" <v-*****@online.microsoft.com> wrote in message
news:mZ****************@cpmsftngxa06.phx.gbl...

Hi Mark,

Does my reply make sense to you ?

If you still have anything unclear, please feel free to tell me.

Best regards,
Jeffrey Tan
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no
rights.