Question

Without doing dirty and nasty ways, I believe this to be not allowable from user mode, even with SE_BACKUP_NAME.

Things I consider dirty and nasty:

1. Figuring out what process owns the handle and writing code to run in that process and close the handle.
2. Reading/parsing the MFT/FAT table
3. Using a Kernel Driver

Answer 1

Yes, there is a way, although it may not suit your needs; it isn’t dirty or nasty, but it’s heavy, i.e., it is not straightforward to code and it creates a disproportionate amount of system load if you’re just trying to read a single file.

However, if you need to do this, this is the only reasonable and safe solution I’m aware of: see the MSDN documentation on the Volume Shadow Copy Service.

Most backup software uses VSS nowadays.