How would that make any sense?
I just tried this, and watched with sysinternals’ FileMon. Given the empty
directory:
“d:\test\delete_me”
I ran the command
d:\test> rmdir delete_me
And here’s the FileMon trace:
4 2:29:28 PM cmd.exe IRP_MJ_CREATE D:\test\delete_me
SUCCESS Attributes:0000 Options:01000021
5 2:29:28 PM cmd.exe IRP_MJ_SET_INFORMATION D:\test\delete_me
SUCCESS FileDispositionInformation
6 2:29:28 PM cmd.exe IRP_MJ_CLEANUP D:\test\delete_me
SUCCESS
7 2:29:28 PM cmd.exe IRP_MJ_CLOSE D:\test\delete_me
SUCCESS
Dave Cox
Hewlett-Packard Co.
HPSO/SSMO (Santa Barbara)
https://ecardfile.com/id/Dave+Cox
-----Original Message-----
From: Jack Brown [mailto:xxxxx@hotmail.com]
Sent: Friday, April 14, 2000 1:57 AM
To: File Systems Developers
Subject: [ntfsd] RE: Recognize when IRP_MJ_SET_INFORMATION
(RenameInformat ion) deletes a directory
FileDispositionInformation is used only for files.
If you delete an empty directory it is done by FileRenameInformation.
From: “COX,DAVID (HP-Roseville,ex1)” <david_cox2>
>Reply-To: “File Systems Developers”
>To: “File Systems Developers”
>Subject: [ntfsd] RE: Recognize when IRP_MJ_SET_INFORMATION
>(RenameInformat ion) deletes a directory
>Date: Thu, 13 Apr 2000 10:17:25 -0700
>
>Why would it use FileRenameInformation to effect a directory delete?
>
>How about FileDispositionInformation, with the struct
>
> FILE_DISPOSITION_INFORMATION
> {
> BOOLEAN DeleteFile;
> }
>
>-----------------------------------------------------------------------
>Dave Cox
>Hewlett-Packard Co.
>HPSO/SSMO (Santa Barbara)
>https://ecardfile.com/id/Dave+Cox
>
>
>-----Original Message-----
>From: Jack Brown [mailto:xxxxx@hotmail.com]
>Sent: Thursday, April 13, 2000 5:00 AM
>To: File Systems Developers
>Subject: [ntfsd] Recognize when IRP_MJ_SET_INFORMATION
>(RenameInformation) deletes a directory
>
>
>I want to recognize the moment when FSD deletes a directory. I found that
>it
>
>is done by IRP_MJ_SET_INFORMATION (FileRenameInformation). I have a file
>system filter and in its completeion routine I am trying to find when
>exactly a directory has been deleted.
>One of the parameters that I have to examine is ReplaceIfExists. I think it
>should be set to TRUE. But is it enough to assume that the directory is
>deleted?
>
>Thanks
>Jack
>
>Get Your Private, Free Email at http://www.hotmail.com
>
>
>—
>You are currently subscribed to ntfsd as: david_cox2@hp.com
>To unsubscribe send a blank email to $subst(‘Email.Unsub’)
>
>—
>You are currently subscribed to ntfsd as: xxxxx@hotmail.com
>To unsubscribe send a blank email to $subst(‘Email.Unsub’)
>
_
Get Your Private, Free Email at http://www.hotmail.com
—
You are currently subscribed to ntfsd as: david_cox2@hp.com
To unsubscribe send a blank email to $subst(‘Email.Unsub’)</david_cox2>