Unlocking file handles on removable USB drive...

Question

0.00/5 (No votes)

See more:

Dear All,

I am writing an application for windows desktop system.This application unlocks a removable USB drives from all the file handles acquired by some applications.

Question:

- Is it right way to unlock the device. (See Below)

- What could be the better way to unlock the device.

Thanks in advance.

-- Raghav

What I have tried:

For this I have written a program in C/C++ using visual studio. I am using NtQuerySystemInformation(), NtDuplicateObject(), NtQueryObject() API to get the handles information and then querying the handle object. If the handle name contains the device name (which has to be unlocked) then I close this handle using the following method-

BOOL WINAPI DuplicateHandle(
_In_ HANDLE hSourceProcessHandle,
_In_ HANDLE hSourceHandle,
_In_ HANDLE hTargetProcessHandle,
_Out_ LPHANDLE lpTargetHandle,
_In_ DWORD dwDesiredAccess,
_In_ BOOL bInheritHandle,
_In_ DWORD dwOptions
);

And in dwOptions I use DUPLICATE_CLOSE_SOURCE so that the source handle (which has locked the device) gets closed and the removable USB device is unlocked.

Posted 12-Apr-16 20:07pm

Raghav Gaur

Updated 19-Apr-16 18:29pm

v2

Add a Solution

Comments

Jochen Arndt 13-Apr-16 3:13am

Why do you want to do this?

Closing a file handle used by another application may result in lost file content which makes binary files invalid and the other application may crash or show undefined behaviour because it will usually not check for valid handles once a file has been opened.

A better solution would be showing a message that there are locked files on the drive and the user should close the files in the applications or close the applications itself. Based on your actual code you might provide the application names for convenience.

Raghav Gaur 13-Apr-16 7:42am

Thanks Jochen,
I want to close handles because I need to unlock the removable device.

Surely I can ask users to close the files or application itself..but what if users don't follow this, forcefully I need to close the handles.

Jochen Arndt 19-Apr-16 6:46am

You should use the Reply button right of a poster's name. Then an email notfication is send. I saw your reply now just by chance.

The answer is simple:
The user might have a reason that he don't want the file to be closed. You (resp. your program) must accept that. The user must have the power. Never try to patronise him.

Raghav Gaur 20-Apr-16 1:36am

thanks for a wonderful piece of advice (reg reply),

I agree with you that users must have the power to exercise but I as a security person have the responsibility to save users for any kind of threat, here threats caused by external pen drive.
If the external device pose a threat to users PC, it must be disconnected from the system.
For this purpose only I was trying to write an application which can unlock the external flash drive followed by its removal from the end users PC.

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

leon de boer · Answer 1 · 2016-04-19T18:29:00

Its a removable media and you can just go thru the eject media process which is actually already on your taskbar

There is an old Code Project running thru it, I don't think anything much has changed so start there
How to Prepare a USB Drive for Safe Removal[^]

Microsoft along the same lines
https://support.microsoft.com/en-us/kb/165721[^]