How do I delete a file that is locked by another process?
You must release the file handle held by the locking process. This involves enumerating all system handles using `NtQuerySystemInformation`, filtering for file handles (ObjectTypeNumber 0x1e), and using `DuplicateHandle` with the `DUPLICATE_CLOSE_SOURCE` option to close the handle. The article [Penetration Techniques - File Recovery and Deletion in Windows Systems](/news/penetration-techniques-file-recovery-and-deletion-in-windows-systems) provides open-source code and explains the required debug privilege elevation.