[NTHandle Logo]

 Copyright © 1997 Mark Russinovich

 Last Updated July26, 1997, Version 1.0

   Introduction Ever wondered which program has a particular file or
                directory open? Now you can find out. NTHandle is a
                utility that displays information about open handles for
                any process in the system. You can use it to see the
                programs that have a file open, or to see the object types
                and names of all the handles of a program.

   Installation You run NTHandle by typing "nthandle". The driver
                (handle.sys) and console program (nthandle.exe) must be
                located in the same directory, which must be on a
                non-network drive. You do not have to be in the same
                directory as the files to run NTHandle, so long as they
                are on your executable path.

                NTHandle has been tested on NT 3.51 and NT 4.0.

          Usage NTHandle is targetted at searching for open file
                references, so if you do not specify any command-line
                parameters it will list the values of all the handles in
                the system that refer to open files and the names of the
                files. It also takes several parameters that modify this
                behavior.

                usage: nthandle [-a] [-p process] [name]

                    -a     Dump information about all types of handles,
                           not just those that refer to files. Other types
                           include ports, Registry keys, synchronization
                           primitives, threads, and processes.

                    -p     Instead of examining all the handles in the
                process    system, this parameter narrows NTHandle's scan
                           to those processes that begin with the name
                           process. Thus:

                           nthandle -p exp

                           would dump the open files for all processes
                           that start with "exp", which would include
                           Explorer.

                    name   This parameter is present so that you can
                           direct NTHandle to search for references to an
                           object with a particular name. For example, if
                           you wanted to know which process (if any) has
                           "c:\winnt\system32" open you could type:

                           nthandle winnt\system

                           The name match is case-insensitive and the
                           fragment specified can be anywhere in the paths
                           you are interested in.

       NTHandle When not in search mode (enabled by specifying a name
         Output fragment as a parameter), NTHandle divides its output into
                sections for each process it is printing handle
                information for. Dashed lines are used as a seperator,
                immediately below which you will see the process name and
                its process id (PID). Beneath the process name are listed
                handle values (in hexadecimal), the type of object the
                handle is associated with, and the name of the object if
                it has one.

                When in search mode, NTHandle prints the process names and
                id's are listed on the left side and the names of the
                objects that had a match are on the right.

           More You can find more information on the Object Manager in
    Information Helen Custer's Inside Windows NT, or by browsing the
                Object Manager name-space with WinObj. I'll also have a
                column on the Object Manager in the October issue of
                Windows NT Magazine.

                          Download NTHandle (18KB)

                                  [Image]