Open Files using Command Line in this when the output obtained from psloggedon.exe commands shows the investigators that there are users logged on to the system remotely, then the investigators will also want to see what files have they opened, if any. Many times when someone accesses a system remotely, they might be looking for something specific while opening files.
A user in a corporate environment could have shared available content and allowed other users to view images, download songs, etc. Anyone can easily gain access to poorly protected systems connected to the Internet, with no administrator– password (and no firewall), and search for files, and may access and copy them. Tools and commands that show files opened remotely on a system include net file command, psfile.exe, and openfiles.exe.
Open Files: net File Command
The net file command displays the names of all open shared files on a server and the number of file locks, if any, on each file. This command can also close individual shared files and remove file locks. When used without parameters, the tool will also display and help to control files shared on the network.
Syntax: net file [ID [/close]]
- ID: Specifies the identification number of the file.
- /close: Closes an open file and releases locked records.
- net help command: Displays help for the specified net command.
Related Product : Computer Hacking Forensic Investigator | CHFI
Open Files: Ps File Utility
Psiile is a command-line utility that can retrieve the list of remotely opened files on a system. It also allows the investigator to close the opened files either by name or by a file identifier. The default behavior of PsFile is to list the files on the local system that are open by remote systems. By typing a command followed by “-” displays information on the syntax for the command.
Syntax: psfile MRemoteComputer [-u Username [-p Password]]] [[Id | path] [-c]]
- u Specifies optional user name for login to remote computer
- p Specifies password for user name
- Id Identifier (as assigned by PsFile) of the file for which to display information or to close.
- Path Full or partial path of files to match for information display or close.
- -c Closes the files identified by ID or path.
Also Read : Introduction of Windows Forensics
Open File: Openfiles Command
Syntax: openfiles.exe /disconnect [/s Computer [/p Password]]] [/u Domain/User {[/id OpenFilelD] | [/a UserName] |[/o OpenMode]} [/se SessionName] [/op OpenFileName]
- /s Computer: Specifies the name or IP address of a remote computer.
- /u Domain \User: Runs the command with the account permissions of the user specified by User or Domain\User.
- /p Password: Specifies the password of the user account that is specified in the \u parameter.
- /id OpenFileID: Disconnects the file opened with the specified numeric OpenFileID on the computer specified by the /s parameter.
- /a UserName: Disconnects all open files that were accessed by the specified user on the computer specified by the /s parameter.
- /o Open ode: Disconnects all open files with the specified OpenMode on the computer specified by the /s parameter.
- /se SessionName: Disconnects all open files that were created by the specified session on the computer specified by the /s parameter.
- /op OpenFileName: Disconnects the open file that was created with the specified OpenFileName on the computer specified by the /s parameter.
- /?: Displays help at the command prompt.
Questions related to this topic
- How do I open a file in DOS?
- How do I open a path in CMD?
- How do I unzip a file in CMD?
- How to Open Files using Command Line?
This Blog Article is posted by
Infosavvy, 2nd Floor, Sai Niketan, Chandavalkar Road Opp. Gora Gandhi Hotel, Above Jumbo King, beside Speakwell Institute, Borivali West, Mumbai, Maharashtra 400092
Contact us – www.info-savvy.com
