RE: Recognize when IRP_MJ_SET_INFORMATION (RenameInfo--rmat ion) deletes a directory

In general, when you “delete” a file or directory through Explorer, the file
is renamed into the Recycle Bin directory. This corresponds to an
IRP_MJ_SET_INFORMATION of class FileRenameInformation. When you empty the
recycle bin, the file is really deleted, which corresponds to an
IRP_MJ_SET_INFORMATION of class FileDispositionInformation.

If you have configured your recycle bin not to collect “deleted” files, then
the file is really deleted, instead of renamed into the recycle bin. This
corresponds to an IRP_MJ_SET_INFORMATION of class
FileDispositionInformation.

When you delete a file or directory from the command line, it is never
placed in the recycle bin. Instead it is deleted with an
IRP_MJ_SET_INFORMATION of class FileDispositionInformation.

Does this help?

-----Original Message-----
From: COX,DAVID (HP-Roseville,ex1) [mailto:david_cox2@hp.com]
Sent: Friday, April 14, 2000 4:53 PM
To: File Systems Developers
Subject: [ntfsd] RE: Recognize when IRP_MJ_SET_INFORMATION (RenameInfo
rmat ion) deletes a directory

How would that make any sense?
I just tried this, and watched with sysinternals’ FileMon.
Given the empty
directory:

“d:\test\delete_me”

I ran the command

d:\test> rmdir delete_me

And here’s the FileMon trace:

4 2:29:28 PM cmd.exe IRP_MJ_CREATE D:\test\delete_me
SUCCESS Attributes:0000 Options:01000021
5 2:29:28 PM cmd.exe IRP_MJ_SET_INFORMATION D:\test\delete_me
SUCCESS FileDispositionInformation
6 2:29:28 PM cmd.exe IRP_MJ_CLEANUP D:\test\delete_me
SUCCESS
7 2:29:28 PM cmd.exe IRP_MJ_CLOSE D:\test\delete_me
SUCCESS



Dave Cox
Hewlett-Packard Co.
HPSO/SSMO (Santa Barbara)
https://ecardfile.com/id/Dave+Cox

-----Original Message-----
From: Jack Brown [mailto:xxxxx@hotmail.com]
Sent: Friday, April 14, 2000 1:57 AM
To: File Systems Developers
Subject: [ntfsd] RE: Recognize when IRP_MJ_SET_INFORMATION
(RenameInformat ion) deletes a directory

FileDispositionInformation is used only for files.
If you delete an empty directory it is done by FileRenameInformation.

>From: “COX,DAVID (HP-Roseville,ex1)” <david_cox2>
> >Reply-To: “File Systems Developers”
> >To: “File Systems Developers”
> >Subject: [ntfsd] RE: Recognize when IRP_MJ_SET_INFORMATION
> >(RenameInformat ion) deletes a directory
> >Date: Thu, 13 Apr 2000 10:17:25 -0700
> >
> >Why would it use FileRenameInformation to effect a directory delete?
> >
> >How about FileDispositionInformation, with the struct
> >
> > FILE_DISPOSITION_INFORMATION
> > {
> > BOOLEAN DeleteFile;
> > }
> >
> >-------------------------------------------------------------
> ----------
> >Dave Cox
> >Hewlett-Packard Co.
> >HPSO/SSMO (Santa Barbara)
> >https://ecardfile.com/id/Dave+Cox
> >
> >
> >-----Original Message-----
> >From: Jack Brown [mailto:xxxxx@hotmail.com]
> >Sent: Thursday, April 13, 2000 5:00 AM
> >To: File Systems Developers
> >Subject: [ntfsd] Recognize when IRP_MJ_SET_INFORMATION
> >(RenameInformation) deletes a directory
> >
> >
> >I want to recognize the moment when FSD deletes a directory.
> I found that
> >it
> >
> >is done by IRP_MJ_SET_INFORMATION (FileRenameInformation). I
> have a file
> >system filter and in its completeion routine I am trying to find when
> >exactly a directory has been deleted.
> >One of the parameters that I have to examine is
> ReplaceIfExists. I think it
> >should be set to TRUE. But is it enough to assume that the
> directory is
> >deleted?
> >
> >Thanks
> >Jack
> >

> >Get Your Private, Free Email at http://www.hotmail.com
> >
> >
> >—
> >You are currently subscribed to ntfsd as: david_cox2@hp.com
> >To unsubscribe send a blank email to $subst(‘Email.Unsub’)
> >
> >—
> >You are currently subscribed to ntfsd as: xxxxx@hotmail.com
> >To unsubscribe send a blank email to $subst(‘Email.Unsub’)
> >
>
>
_
> Get Your Private, Free Email at http://www.hotmail.com
>
>
> —
> You are currently subscribed to ntfsd as: david_cox2@hp.com
> To unsubscribe send a blank email to $subst(‘Email.Unsub’)
>
> —
> You are currently subscribed to ntfsd as: xxxxx@nsisw.com
> To unsubscribe send a blank email to $subst(‘Email.Unsub’)
></david_cox2>