New Russinovich tool scans for open file references from command line

If you are trying to delete or move a file and a program has a handle left open -- even if it's not actually doing anything with it, check out this recently updated tool from Mark Russinovich. Handle v 3.30 repackages handle-specific functions from the command line and with better granularity than his classic Process Explorer.

I've written before about utilities that search for open file or directory processes and allow you to gracefully (or forcefully) close those connections. Most of these types of programs are friendly GUI-driven products that snap into Windows Explorer's right-click context menu. But I thought I'd talk about a recently updated tool that's (a) a command-line item and (b) written by someone who's created easily some of the best third-party...

add-on utilities for Windows as a whole.

I speak of Mark Russinovich and his command-line tool Handle, now in version 3.30. Handle 3.3 helps if you're trying to delete or move something and a program has stupidly left a handle open on a given file even if it's not actually doing anything with it. This functionality is also available through Russinovich's now-classic Process Explorer. But Handle repackages the handle-specific functions in a way that they can be used as part of a script or with better granularity than what you'd be able to get from the Process Explorer UI.

If you run Handle 3.3 without any command-line parameters, it'll simply dump out a list of all the open handles in the system -- which can be a very long list, so be warned. (Out of curiosity, I dumped out my own desktop's open-handles list to a text file and got a file 110K in size.)

If you use the -p switch in conjunction with a process name (a partial name is OK), you'll get a list of all the handles for all the processes that match that name. Each handle also has an associated hexadecimal ID, shown to the left of the filename. Example:

28A: File (---) D:\PORTAB~1.0\PORTAB~1\FIREFO~1\App\firefox\chrome\browser.jar

This file (dumped from a running instance of Portable Firefox, from the PortableApps collection) has a hex ID of 28A.

When you want to close a handle, use the -c switch to specify which handle, and you need to specify an exact process ID number with the -p switch. If I wanted to close this particular handle, I'd use the command line handle –c 28A –p 4056 (with 4056 being the process ID for Firefox here).

It's also possible to scan for handles by file rather than executable. If you specify a filename as the first argument for the program, you'll see all the processes that have that file open as a handle. Specify a directory and Handle will iterate through everything in the directory that has a handle open on it.

Keep in mind that terminating an open handle is always a slightly risky proposition. A program that doesn't accept such a thing gracefully may crash, and if you close an open handle on a system component, you can potentially hang the system up entirely.

Finally, note that you'll need administrative privileges to run Handle 3.3; in Vista, you can only run Handle from an elevated command prompt.

Serdar Yegulalp is editor of Windows Insight (formerly the Windows Power Users Newsletter), a blog site devoted to hints, tips, tricks and news for users and administrators of Windows NT, Windows 2000, Windows XP, Windows Server 2003 and Vista. He has more than 12 years of experience working with Windows, and contributes regularly to and other TechTarget sites.

This was first published in November 2007

Dig deeper on Windows Server Virtualization and Microsoft Hyper-V



Enjoy the benefits of Pro+ membership, learn more and join.



Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: