Windows sysinternals

256 Part II Usage Guide
Handle
Handle is a console utility that displays information about object handles held by processes
on the system. Handles represent open instances of basic operating system objects that
applications interact with, such as files, registry keys, synchronization primitives, and shared
memory. You can use the Handle utility to search for programs that have a file or folder
open, preventing its access or deletion from another program. You can also use Handle to list
the object types and names held by a particular program. For more information about object
handles, see “Handles” in Chapter 2.
Because the primary purpose for Handle is to identify in-use files and folders, running
Handle without any command-line parameters lists all the File and named Section handles
owned by those processes. Handle’s command-line parameters in various combinations
allow you to list all object types, search for objects by name, limit which process or processes
to include, display handle counts by object type, show details about pagefile-backed
Section objects, display the user name with the handle information, or (although generally
ill- advised) close open handles.
Note that loading a DLL or mapping another file type into a process’ address space via
the LoadLibrary API does not also add a handle to the process’ handle table. Such files can
therefore be in use and not be able to be deleted, even though a handle search might come
up empty. ListDLLs, described earlier in this chapter, can identify DLLs loaded as executable
images. More powerfully, Process Explorer’s Find feature searches for both DLL and
handle names in a single operation, and it includes DLLs mapped as data. Process Explorer is
described in Chapter 3.
Handle List and Search
The command-line syntax to list object handles is
handle [-a [-l]] [-p process|PID] [[-u] objname]
If you specify no command-line parameters, Handle lists all processes and all the File and
named Section handles owned by those processes, with dashed-line separators between the
information for each process. For each process, Handle displays the process name, PID, and
account name that the process is running under, followed by the handles belonging to that
process. The handle value is displayed in hexadecimal, along with the object type and the
object name (if it has one).
“File” handles can include folders, device drivers, and communication endpoints, in addition
to normal files. File handle information also includes the sharing mode that was set when
the handle was opened. The parenthesized sharing flags can include R, W, or D, indicating
www.it-ebooks.info