How to find which program has a file in use

Published on Monday, 25 June 2018

File is use

I am sure you all have run into the problem where you want to either delete, rename or move a file but you get the dreaded file in use error. What is more annoying is when you can't find out what is using it and release it.

Sysinternals Handle

The first and easiest tool to use to determine what has a file open is handle.exe from sysinterals. You can download it from here.

How to use

To search for which application is in use run the command below (replace path with full path to file you want to check). You can also put part of a path as the file name but you can't use wildcards. E.g. you can put c:\path\bla and it will show you all handles in use for c:\path\bla and applications and folders under it.

handle.exe c:\path\to\file.exe

Handle

Process Explorer

You can also use process explorer to get a simlar result. This is useful if you want to look at more information from the processes that have the file locked.

How to use

Open Process explorer as an admin (you can elevate from the file menu if you need to).

From the find menu select Find Handle or DLL.

You can now have to either enter the full path of the file or part of the path (like above with the handle command). You can't use wild cards however.

Process Explorer

If you double click on the file and program in the search results you will be taken to the process object in process explorer where you can find more information about the process.

How to detatch a file from a process.

Another thing you can do with both of these programs is detatch the process from the file without closing it. This can be useful if you don't want to close the program but need to access the file.

Be very careful doing this though, if the program tries to access the file it thinks it has a handle for it can crash the program or cause other unexpected results.

Handle

You can close a handle by running the following:

handle.exe -c <handle number> -p <pid>

The handle number can be retrieved by using the handle command above. Handle ID's are unique to the process and change everytime the process is run.

The pid is the process id of the process that has the handle open. It is important you use the pid and not the name of the process.

Process explorer

This one is a lot easier to do. All you have to do is double click on the file searched for above and view the handles in the lower pane of process explorer. Once you have done that you can right click on the file/handle you want to close and select close handle.

Process Explorer