CODEWITHSUNDEEP
windowscomputer-forensics
user1197457
user1197457

Reputation: 59

In Windows is it always necessary to use a handle to access a file?

In other words, is it possible to access a file without a handle being utilized?

Upvotes: 0

Views: 65

Answers (2)

Harry Johnston
Harry Johnston

Reputation: 36328

For code running in user mode, any operation on a file will involve a handle of some kind, though not necessarily to the file in question. There are APIs that don't expose the handle to the programmer, but there is always one there.

In kernel mode, although it is usual to use handles for file operations, it is not necessary. For example, the file server component doesn't appear to open file handles when it is accessing a file on behalf of a remote user.

Upvotes: 0

Stefan Wanitzek
Stefan Wanitzek

Reputation: 2124

You could use the CreateFile()-API to create a handle to the raw file-system and then parse the file structure by yourself (this is more work as it sounds!)

Though this would require admin-rights. This wouldn't trigger any hooks you have on CreateFile() or other file-related API-functions.

This wouldn't create a handle to the file but you still need a handle to the device.

Upvotes: 1

Related Questions