Forum Discussion
How I can achive information about which process is handling files/directories?
Hello,
here is the idea:
I have a lot of services with name xxx.exe (and diffrent PID of course). Which service have own directory.
Let's say we have 5 services and directories: C:\srv\service1,...., C:\srv\service5
As I mentioned just a second ago the name of the services are the same. I want to know which pid is for the xxx.exe proces handling C:\srv\service1 etc.
What I know for now is that they aren't manipulating on the files and directories directly. I found out that they are creating a child process and that process are create another child process.
So we have something like that per each process:
xxx.exe has the child process yyy.exe. yyy.exe has the child process zzz.exe and this proces is using for file and directory operations.
So at first I must findout PID of the zzz.exe process for particular xxx.exe process. That's the easy part. After this I need to findout a list of files/directories handling by zzz.exe process. Seems that is even more challenging than I thought.
I've read a lot of articles, tried a lot of methods and nothing works. For example a lot of people are using combination of power script with sysinternal handle tools. In my case it's useless. That tool works for most of processes but not for zzz.exe. It shows information that the process could not be opened. If I put the directory path list is empty.
Only one tool has no problem with that - sysinternal process monitor. Unfortunately it's a graphical tool so I can't use this in the script. I am not a powershell expert so I hope that here I can find helpful experts and thay can give me a hint how I can make something similiar as sysinternal process monitor in powershell. Of course I need just part of the functionality. In my case I just want to have a list of handlinf files or directorys for particular process id.
Any ideas?
2 Replies
- farismalaebIron Contributor
Check these.
https://www.cloudsavvyit.com/2956/how-to-manage-open-file-handles-with-powershell/
https://mcpmag.com/articles/2018/07/10/check-for-locked-file-using-powershell.aspx
Hope these can help or give you an idea of how to do it
==========
Please client on Best response if this answer help.
- lukasz-ziCopper Contributor
farismalaebas I said handle tool it's unuseful in my case. That second method do not give me an information about process ID which I am looking for so it's also unuseful.