How to View Owner of Files on Local or Network Server Shared Folders / Mapped Drives

When dealing with unknown or suspicious files, especially after a virus, malware, Trojan, rookit, ransomware or other malicious infection, you may need to figure out who is the user who created the files, i.e. the owner of the files.

In networked environment with shared folders and mappedd rives, finding the owner of the files who created or modified the files help to trace identify the source which the files came from, and in the case of infection outbreak, help to isolate the problem.

Use one of the following to determine the owner of the file:

Method 1: File Properties’ Details

Right click on the file in Windows Explorer or File Explorer, then select Properties. Then go to Details tab. If available, the Owner information will be listed.

Method 2: File Properties’ Security

Right click on the file in Windows Explorer or File Explorer, then select Properties. Then go to Security tab. Click or tap on Advanced button, and you will be able to see the Owner listed.

Note in older versions of Windows prior to Windows 10, you may need to go to Owner tab to view current owner information.

Method 3: Dir /Q Command

Dir command has a switch that can display the owner of the file, and that’s /Q. To display the ownership information, just type the following command:

dir /q <file name>

The command works for all users, no administrative rights required! You can omit the file name to display all files and directories for current folder, together with their owners.

Method 4: SubInACL

SubInACL is a command-line tool that enables administrators to obtain security information about files, registry keys, and services, and transfer this information from user to user, from local or global group to group, and from domain to domain. It’s able can be used to view ownership of files.

Download SubInACL from Microsoft. Then open an Admin Command Prompt, and type the following command to view the current owner:

subinacl /file <file name>