How do I delete a file that is locked by another process?
You must release the file handle held by the locking process. This involves enumerating all system handles using `NtQuerySystemInformation`, filtering for file handles (ObjectTypeNumber 0x1e), and using `DuplicateHandle` with the `DUPLICATE_CLOSE_SOURCE` option to close the handle. The article Penetration Techniques - File Recovery and Deletion in Windows Systems provides open-source code and explains the required debug privilege elevation.
file lockhandle enumerationDuplicateHandleNtQuerySystemInformationrelease handle