Ever wondered which program has a particular file or directory open? Now you can find out. Handle is a utility that displays information about open handles for any process in the system. You can use it to see the programs that have a file open, or to see the object types and names of all the handles of a program.
You can also get a GUI-based version of this program, Process Explorer, here at Sysinternals.
Installation
You run Handle by typing «handle». You must have administrative privilege to run Handle.
Usage
Handle is targeted at searching for open file references, so if you do not specify any command-line parameters it will list the values of all the handles in the system that refer to open files and the names of the files. It also takes several parameters that modify this behavior.
Dump information about all types of handles, not just those that refer to files. Other types include ports, Registry keys, synchronization primitives, threads, and processes.
-c
Closes the specified handle (interpreted as a hexadecimal number). You must specify the process by its PID. WARNING: Closing handles can cause application or system instability.
-l
Dump the sizes of pagefile-backed sections.
-y
Don’t prompt for close handle confirmation.
-s
Print count of each type of handle open.
-u
Show the owning user name when searching for handles.
-p
Instead of examining all the handles in the system, this parameter narrows Handle’s scan to those processes that begin with the name process. Thus: handle -p exp would dump the open files for all processes that start with «exp», which would include Explorer.
name
This parameter is present so that you can direct Handle to search for references to an object with a particular name. For example, if you wanted to know which process (if any) has «c:\windows\system32» open you could type: handle windows\system The name match is case-insensitive and the fragment specified can be anywhere in the paths you are interested in.
Handle Output
When not in search mode (enabled by specifying a name fragment as a parameter), Handle divides its output into sections for each process it is printing handle information for. Dashed lines are used as a separator, immediately below which you will see the process name and its process id (PID). Beneath the process name are listed handle values (in hexadecimal), the type of object the handle is associated with, and the name of the object if it has one.
When in search mode, Handle prints the process names and id’s are listed on the left side and the names of the objects that had a match are on the right.
More Information
You can find more information on the Object Manager in Windows Internals, 4th Edition or by browsing the Object Manager name-space with WinObj.
Download Handle(887 KB)
SetFileInformationByHandle function (fileapi.h)
Sets the file information for the specified file.
To retrieve file information using a file handle, see GetFileInformationByHandle or GetFileInformationByHandleEx.
Syntax
Parameters
A handle to the file for which to change information.
This handle must be opened with the appropriate permissions for the requested change. For more information, see the Remarks and Example Code sections.
This handle should not be a pipe handle.
A FILE_INFO_BY_HANDLE_CLASS enumeration value that specifies the type of information to be changed.
For a table of valid values, see the Remarks section.
A pointer to the buffer that contains the information to change for the specified file information class. The structure that this parameter points to corresponds to the class that is specified by FileInformationClass.
For a table of valid structure types, see the Remarks section.
The size of lpFileInformation, in bytes.
Return value
Returns nonzero if successful or zero otherwise.
To get extended error information, call GetLastError.
Remarks
Certain file information classes behave slightly differently on different operating system releases. These classes are supported by the underlying drivers, and any information they return is subject to change between operating system releases.
The following table shows the valid file information classes and their corresponding data structure types for use with this function.
FileInformationClass value
lpFileInformation type
FileBasicInfo
FileRenameInfo
FileDispositionInfo
FileAllocationInfo
FileEndOfFileInfo
FileIoPriorityHintInfo
You must specify appropriate access flags when creating the file handle for use with SetFileInformationByHandle. For example, if the application is using FILE_DISPOSITION_INFO with the DeleteFile member set to TRUE, the file would need DELETE access requested in the call to the CreateFile function. To see an example of this, see the Example Code section. For more information about file permissions, see File Security and Access Rights.
If there is a transaction bound to the handle, then the changes made will be transacted for the information classes FileBasicInfo, FileRenameInfo, FileAllocationInfo, FileEndOfFileInfo, and FileDispositionInfo. If FileDispositionInfo is specified, only the delete operation is transacted if a DeleteFile operation was requested. In this case, if the transaction is not committed before the handle is closed, the deletion will not occur. For more information about TxF, see Transactional NTFS (TxF).
In WindowsВ 8 and Windows ServerВ 2012, this function is supported by the following technologies.
Technology
Supported
Server Message Block (SMB) 3.0 protocol
Yes
SMB 3.0 Transparent Failover (TFO)
See comment
SMB 3.0 with Scale-out File Shares (SO)
See comment
Cluster Shared Volume File System (CsvFS)
Yes
Resilient File System (ReFS)
Yes
В
SMB 3.0 does not support rename of alternate data streams on file shares with continuous availability capability.
Examples
The following C++ example shows how to create a file and mark it for deletion when the handle is closed.
Windows Data Types
The data types supported by Windows are used to define function return values, function and message parameters, and structure members. They define the size and meaning of these elements. For more information about the underlying C/C++ data types, see Data Type Ranges.
The following table contains the following types: character, integer, Boolean, pointer, and handle. The character, integer, and Boolean types are common to most C compilers. Most of the pointer-type names begin with a prefix of P or LP. Handles refer to a resource that has been loaded into memory.
For more information about handling 64-bit integers, see Large Integers.
Data type
Description
APIENTRY
The calling convention for system functions. This type is declared in WinDef.h as follows: #define APIENTRY WINAPI
ATOM
An atom. For more information, see About Atom Tables. This type is declared in WinDef.h as follows: typedef WORD ATOM;
BOOL
A Boolean variable (should be TRUE or FALSE). This type is declared in WinDef.h as follows: typedef int BOOL;
BOOLEAN
A Boolean variable (should be TRUE or FALSE). This type is declared in WinNT.h as follows: typedef BYTE BOOLEAN;
BYTE
A byte (8 bits). This type is declared in WinDef.h as follows: typedef unsigned char BYTE;
CALLBACK
The calling convention for callback functions. This type is declared in WinDef.h as follows: #define CALLBACK __stdcall CALLBACK, WINAPI, and APIENTRY are all used to define functions with the __stdcall calling convention. Most functions in the Windows API are declared using WINAPI. You may wish to use CALLBACK for the callback functions that you implement to help identify the function as a callback function.
CCHAR
An 8-bit Windows (ANSI) character. This type is declared in WinNT.h as follows: typedef char CCHAR;
CHAR
An 8-bit Windows (ANSI) character. For more information, see Character Sets Used By Fonts. This type is declared in WinNT.h as follows: typedef char CHAR;
COLORREF
The red, green, blue (RGB) color value (32 bits). See COLORREF for information on this type. This type is declared in WinDef.h as follows: typedef DWORD COLORREF;
CONST
A variable whose value is to remain constant during execution. This type is declared in WinDef.h as follows: #define CONST const
DWORD
A 32-bit unsigned integer. The range is 0 through 4294967295 decimal. This type is declared in IntSafe.h as follows: typedef unsigned long DWORD;
DWORDLONG
A 64-bit unsigned integer. The range is 0 through 18446744073709551615 decimal. This type is declared in IntSafe.h as follows: typedef unsigned __int64 DWORDLONG;
DWORD_PTR
An unsigned long type for pointer precision. Use when casting a pointer to a long type to perform pointer arithmetic. (Also commonly used for general 32-bit parameters that have been extended to 64 bits in 64-bit Windows.) This type is declared in BaseTsd.h as follows: typedef ULONG_PTR DWORD_PTR;
DWORD32
A 32-bit unsigned integer. This type is declared in BaseTsd.h as follows: typedef unsigned int DWORD32;
DWORD64
A 64-bit unsigned integer. This type is declared in BaseTsd.h as follows: typedef unsigned __int64 DWORD64;
FLOAT
A floating-point variable. This type is declared in WinDef.h as follows: typedef float FLOAT;
HACCEL
A handle to an accelerator table. This type is declared in WinDef.h as follows: typedef HANDLE HACCEL;
HALF_PTR
Half the size of a pointer. Use within a structure that contains a pointer and two small fields. This type is declared in BaseTsd.h as follows:
C++
HANDLE
A handle to an object.
This type is declared in WinNT.h as follows:
typedef PVOID HANDLE;
This type is declared in WinDef.h as follows:
typedef HANDLE HBITMAP;
This type is declared in WinDef.h as follows:
typedef HANDLE HBRUSH;
This type is declared in WinDef.h as follows:
typedef HANDLE HCOLORSPACE;
A handle to a dynamic data exchange (DDE) conversation.
This type is declared in Ddeml.h as follows:
typedef HANDLE HCONV;
A handle to a DDE conversation list.
This type is declared in Ddeml.h as follows:
typedef HANDLE HCONVLIST;
This type is declared in WinDef.h as follows:
typedef HICON HCURSOR;
This type is declared in WinDef.h as follows:
typedef HANDLE HDC;
A handle to DDE data.
This type is declared in Ddeml.h as follows:
typedef HANDLE HDDEDATA;
This type is declared in WinDef.h as follows:
typedef HANDLE HDESK;
A handle to an internal drop structure.
This type is declared in ShellApi.h as follows:
typedef HANDLE HDROP;
A handle to a deferred window position structure.
This type is declared in WinUser.h as follows:
typedef HANDLE HDWP;
This type is declared in WinDef.h as follows:
typedef HANDLE HENHMETAFILE;
This type is declared in WinDef.h as follows:
typedef int HFILE;
This type is declared in WinDef.h as follows:
typedef HANDLE HFONT;
A handle to a GDI object.
This type is declared in WinDef.h as follows:
typedef HANDLE HGDIOBJ;
A handle to a global memory block.
This type is declared in WinDef.h as follows:
typedef HANDLE HGLOBAL;
This type is declared in WinDef.h as follows:
typedef HANDLE HHOOK;
This type is declared in WinDef.h as follows:
typedef HANDLE HICON;
A handle to an instance. This is the base address of the module in memory.
HMODULE and HINSTANCE are the same today, but represented different things in 16-bit Windows.
This type is declared in WinDef.h as follows:
typedef HANDLE HINSTANCE;
A handle to a registry key.
This type is declared in WinDef.h as follows:
typedef HANDLE HKEY;
An input locale identifier.
This type is declared in WinDef.h as follows:
typedef HANDLE HKL;
A handle to a local memory block.
This type is declared in WinDef.h as follows:
typedef HANDLE HLOCAL;
This type is declared in WinDef.h as follows:
typedef HANDLE HMENU;
This type is declared in WinDef.h as follows:
typedef HANDLE HMETAFILE;
A handle to a module. The is the base address of the module in memory.
HMODULE and HINSTANCE are the same in current versions of Windows, but represented different things in 16-bit Windows.
This type is declared in WinDef.h as follows:
typedef HINSTANCE HMODULE;
A handle to a display monitor.
This type is declared in WinDef.h as follows:
if(WINVER >= 0x0500) typedef HANDLE HMONITOR;
A handle to a palette.
This type is declared in WinDef.h as follows:
typedef HANDLE HPALETTE;
This type is declared in WinDef.h as follows:
typedef HANDLE HPEN;
The return codes used by COM interfaces. For more information, see Structure of the COM Error Codes. To test an HRESULT value, use the FAILED and SUCCEEDED macros.
This type is declared in WinNT.h as follows:
typedef LONG HRESULT;
This type is declared in WinDef.h as follows:
typedef HANDLE HRGN;
A handle to a resource.
This type is declared in WinDef.h as follows:
typedef HANDLE HRSRC;
A handle to a DDE string.
This type is declared in Ddeml.h as follows:
typedef HANDLE HSZ;
This type is declared in WinDef.h as follows:
typedef HANDLE WINSTA;
This type is declared in WinDef.h as follows:
typedef HANDLE HWND;
A 32-bit signed integer. The range is -2147483648 through 2147483647 decimal.
This type is declared in WinDef.h as follows:
typedef int INT;
A signed integer type for pointer precision. Use when casting a pointer to an integer to perform pointer arithmetic.
This type is declared in BaseTsd.h as follows:
An 8-bit signed integer.
This type is declared in BaseTsd.h as follows:
typedef signed char INT8;
A 16-bit signed integer.
This type is declared in BaseTsd.h as follows:
typedef signed short INT16;
A 32-bit signed integer. The range is -2147483648 through 2147483647 decimal.
This type is declared in BaseTsd.h as follows:
typedef signed int INT32;
A 64-bit signed integer. The range is -9223372036854775808 through 9223372036854775807 decimal.
This type is declared in BaseTsd.h as follows:
typedef signed __int64 INT64;
A language identifier. For more information, see Language Identifiers.
This type is declared in WinNT.h as follows:
typedef WORD LANGID;
A locale identifier. For more information, see Locale Identifiers.
This type is declared in WinNT.h as follows:
typedef DWORD LCID;
A locale information type. For a list, see Locale Information Constants.
This type is declared in WinNls.h as follows:
typedef DWORD LCTYPE;
This type is declared in WinNls.h as follows:
typedef DWORD LGRPID;
A 32-bit signed integer. The range is -2147483648 through 2147483647 decimal.
This type is declared in WinNT.h as follows:
typedef long LONG;
A 64-bit signed integer. The range is -9223372036854775808 through 9223372036854775807 decimal.
This type is declared in WinNT.h as follows:
A signed long type for pointer precision. Use when casting a pointer to a long to perform pointer arithmetic.
This type is declared in BaseTsd.h as follows:
A 32-bit signed integer. The range is -2147483648 through 2147483647 decimal.
This type is declared in BaseTsd.h as follows:
typedef signed int LONG32;
A 64-bit signed integer. The range is -9223372036854775808 through 9223372036854775807 decimal.
This type is declared in BaseTsd.h as follows:
typedef __int64 LONG64;
A message parameter.
This type is declared in WinDef.h as follows:
typedef LONG_PTR LPARAM;
This type is declared in WinDef.h as follows:
typedef BOOL far *LPBOOL;
This type is declared in WinDef.h as follows:
typedef BYTE far *LPBYTE;
This type is declared in WinDef.h as follows:
typedef DWORD *LPCOLORREF;
A pointer to a constant null-terminated string of 8-bit Windows (ANSI) characters. For more information, see Character Sets Used By Fonts.
This type is declared in WinNT.h as follows:
typedef __nullterminated CONST CHAR *LPCSTR;
An LPCWSTR if UNICODE is defined, an LPCSTR otherwise. For more information, see Windows Data Types for Strings.
This type is declared in WinNT.h as follows:
A pointer to a constant of any type.
This type is declared in WinDef.h as follows:
typedef CONST void *LPCVOID;
A pointer to a constant null-terminated string of 16-bit Unicode characters. For more information, see Character Sets Used By Fonts.
This type is declared in WinNT.h as follows:
typedef CONST WCHAR *LPCWSTR;
This type is declared in WinDef.h as follows:
typedef DWORD *LPDWORD;
This type is declared in WinDef.h as follows:
typedef HANDLE *LPHANDLE;
This type is declared in WinDef.h as follows:
typedef int *LPINT;
This type is declared in WinDef.h as follows:
typedef long *LPLONG;
A pointer to a null-terminated string of 8-bit Windows (ANSI) characters. For more information, see Character Sets Used By Fonts.
This type is declared in WinNT.h as follows:
typedef CHAR *LPSTR;
An LPWSTR if UNICODE is defined, an LPSTR otherwise. For more information, see Windows Data Types for Strings.
This type is declared in WinNT.h as follows:
A pointer to any type.
This type is declared in WinDef.h as follows:
typedef void *LPVOID;
This type is declared in WinDef.h as follows:
typedef WORD *LPWORD;
A pointer to a null-terminated string of 16-bit Unicode characters. For more information, see Character Sets Used By Fonts.
This type is declared in WinNT.h as follows:
typedef WCHAR *LPWSTR;
Signed result of message processing.
This type is declared in WinDef.h as follows:
typedef LONG_PTR LRESULT;
This type is declared in WinDef.h as follows:
typedef BOOL *PBOOL;
This type is declared in WinNT.h as follows:
typedef BOOLEAN *PBOOLEAN;
This type is declared in WinDef.h as follows:
typedef BYTE *PBYTE;
This type is declared in WinNT.h as follows:
typedef CHAR *PCHAR;
A pointer to a constant null-terminated string of 8-bit Windows (ANSI) characters. For more information, see Character Sets Used By Fonts.
This type is declared in WinNT.h as follows:
typedef CONST CHAR *PCSTR;
A PCWSTR if UNICODE is defined, a PCSTR otherwise. For more information, see Windows Data Types for Strings.
This type is declared in WinNT.h as follows:
A pointer to a constant null-terminated string of 16-bit Unicode characters. For more information, see Character Sets Used By Fonts.
This type is declared in WinNT.h as follows:
typedef CONST WCHAR *PCWSTR;
This type is declared in WinDef.h as follows:
typedef DWORD *PDWORD;
This type is declared in WinNT.h as follows:
typedef DWORDLONG *PDWORDLONG;
This type is declared in BaseTsd.h as follows:
typedef DWORD_PTR *PDWORD_PTR;
This type is declared in BaseTsd.h as follows:
typedef DWORD32 *PDWORD32;
This type is declared in BaseTsd.h as follows:
typedef DWORD64 *PDWORD64;
This type is declared in WinDef.h as follows:
typedef FLOAT *PFLOAT;
This type is declared in BaseTsd.h as follows:
This type is declared in WinNT.h as follows:
typedef HANDLE *PHANDLE;
This type is declared in WinDef.h as follows:
typedef HKEY *PHKEY;
This type is declared in WinDef.h as follows:
typedef int *PINT;
This type is declared in BaseTsd.h as follows:
typedef INT_PTR *PINT_PTR;
This type is declared in BaseTsd.h as follows:
typedef INT8 *PINT8;
This type is declared in BaseTsd.h as follows:
typedef INT16 *PINT16;
This type is declared in BaseTsd.h as follows:
typedef INT32 *PINT32;
This type is declared in BaseTsd.h as follows:
typedef INT64 *PINT64;
This type is declared in WinNT.h as follows:
typedef PDWORD PLCID;
This type is declared in WinNT.h as follows:
typedef LONG *PLONG;
This type is declared in WinNT.h as follows:
typedef LONGLONG *PLONGLONG;
This type is declared in BaseTsd.h as follows:
typedef LONG_PTR *PLONG_PTR;
This type is declared in BaseTsd.h as follows:
typedef LONG32 *PLONG32;
This type is declared in BaseTsd.h as follows:
typedef LONG64 *PLONG64;
A 32-bit pointer. On a 32-bit system, this is a native pointer. On a 64-bit system, this is a truncated 64-bit pointer.
This type is declared in BaseTsd.h as follows:
A 64-bit pointer. On a 64-bit system, this is a native pointer. On a 32-bit system, this is a sign-extended 32-bit pointer.
Note that it is not safe to assume the state of the high pointer bit.
This type is declared in BaseTsd.h as follows:
A signed pointer.
This type is declared in BaseTsd.h as follows:
#define POINTER_SIGNED __sptr
POINTER_UNSIGNED
An unsigned pointer.
This type is declared in BaseTsd.h as follows:
#define POINTER_UNSIGNED __uptr
This type is declared in WinNT.h as follows:
typedef SHORT *PSHORT;
This type is declared in BaseTsd.h as follows:
typedef SIZE_T *PSIZE_T;
This type is declared in BaseTsd.h as follows:
typedef SSIZE_T *PSSIZE_T;
A pointer to a null-terminated string of 8-bit Windows (ANSI) characters. For more information, see Character Sets Used By Fonts.
This type is declared in WinNT.h as follows:
typedef CHAR *PSTR;
This type is declared in WinNT.h as follows:
typedef TBYTE *PTBYTE;
This type is declared in WinNT.h as follows:
typedef TCHAR *PTCHAR;
A PWSTR if UNICODE is defined, a PSTR otherwise. For more information, see Windows Data Types for Strings.
This type is declared in WinNT.h as follows:
This type is declared in WinDef.h as follows:
typedef UCHAR *PUCHAR;
This type is declared in BaseTsd.h as follows:
This type is declared in WinDef.h as follows:
typedef UINT *PUINT;
This type is declared in BaseTsd.h as follows:
typedef UINT_PTR *PUINT_PTR;
This type is declared in BaseTsd.h as follows:
typedef UINT8 *PUINT8;
This type is declared in BaseTsd.h as follows:
typedef UINT16 *PUINT16;
This type is declared in BaseTsd.h as follows:
typedef UINT32 *PUINT32;
This type is declared in BaseTsd.h as follows:
typedef UINT64 *PUINT64;
This type is declared in WinDef.h as follows:
typedef ULONG *PULONG;
This type is declared in WinDef.h as follows:
typedef ULONGLONG *PULONGLONG;
This type is declared in BaseTsd.h as follows:
typedef ULONG_PTR *PULONG_PTR;
This type is declared in BaseTsd.h as follows:
typedef ULONG32 *PULONG32;
This type is declared in BaseTsd.h as follows:
typedef ULONG64 *PULONG64;
This type is declared in WinDef.h as follows:
typedef USHORT *PUSHORT;
A pointer to any type.
This type is declared in WinNT.h as follows:
typedef void *PVOID;
This type is declared in WinNT.h as follows:
typedef WCHAR *PWCHAR;
This type is declared in WinDef.h as follows:
typedef WORD *PWORD;
A pointer to a null-terminated string of 16-bit Unicode characters. For more information, see Character Sets Used By Fonts.
This type is declared in WinNT.h as follows:
typedef WCHAR *PWSTR;
A 64-bit unsigned integer.
This type is declared as follows:
typedef unsigned __int64 QWORD;
A handle to a service control manager database. For more information, see SCM Handles.
This type is declared in WinSvc.h as follows:
typedef HANDLE SC_HANDLE;
A lock to a service control manager database. For more information, see SCM Handles.
This type is declared in WinSvc.h as follows:
typedef LPVOID SC_LOCK;
SERVICE_STATUS_HANDLE
A handle to a service status value. For more information, see SCM Handles.
This type is declared in WinSvc.h as follows:
typedef HANDLE SERVICE_STATUS_HANDLE;
A 16-bit integer. The range is -32768 through 32767 decimal.
This type is declared in WinNT.h as follows:
typedef short SHORT;
The maximum number of bytes to which a pointer can point. Use for a count that must span the full range of a pointer.
This type is declared in BaseTsd.h as follows:
typedef ULONG_PTR SIZE_T;
This type is declared in BaseTsd.h as follows:
typedef LONG_PTR SSIZE_T;
A WCHAR if UNICODE is defined, a CHAR otherwise.
This type is declared in WinNT.h as follows:
A WCHAR if UNICODE is defined, a CHAR otherwise.
This type is declared in WinNT.h as follows:
This type is declared in WinDef.h as follows:
typedef unsigned char UCHAR;
An unsigned HALF_PTR. Use within a structure that contains a pointer and two small fields.
This type is declared in BaseTsd.h as follows:
An unsigned INT. The range is 0 through 4294967295 decimal.
This type is declared in WinDef.h as follows:
typedef unsigned int UINT;
This type is declared in BaseTsd.h as follows:
This type is declared in BaseTsd.h as follows:
typedef unsigned char UINT8;
This type is declared in BaseTsd.h as follows:
typedef unsigned short UINT16;
An unsigned INT32. The range is 0 through 4294967295 decimal.
This type is declared in BaseTsd.h as follows:
typedef unsigned int UINT32;
An unsigned INT64. The range is 0 through 18446744073709551615 decimal.
This type is declared in BaseTsd.h as follows:
typedef usigned __int 64 UINT64;
An unsigned LONG. The range is 0 through 4294967295 decimal.
This type is declared in WinDef.h as follows:
typedef unsigned long ULONG;
A 64-bit unsigned integer. The range is 0 through 18446744073709551615 decimal.
This type is declared in WinNT.h as follows:
This type is declared in BaseTsd.h as follows:
An unsigned LONG32. The range is 0 through 4294967295 decimal.
This type is declared in BaseTsd.h as follows:
typedef unsigned int ULONG32;
An unsigned LONG64. The range is 0 through 18446744073709551615 decimal.
This type is declared in BaseTsd.h as follows:
typedef unsigned __int64 ULONG64;
A Unicode string.
This type is declared in Winternl.h as follows:
An unsigned SHORT. The range is 0 through 65535 decimal.
This type is declared in WinDef.h as follows:
typedef unsigned short USHORT;
An update sequence number (USN).
This type is declared in WinNT.h as follows:
typedef LONGLONG USN;
This type is declared in WinNT.h as follows:
#define VOID void
A 16-bit Unicode character. For more information, see Character Sets Used By Fonts.
This type is declared in WinNT.h as follows:
typedef wchar_t WCHAR;
The calling convention for system functions.
This type is declared in WinDef.h as follows:
#define WINAPI __stdcall
CALLBACK, WINAPI, and APIENTRY are all used to define functions with the __stdcall calling convention. Most functions in the Windows API are declared using WINAPI. You may wish to use CALLBACK for the callback functions that you implement to help identify the function as a callback function.
A 16-bit unsigned integer. The range is 0 through 65535 decimal.
Download Handle (887 KB)
