Thanks Rob,
That was exacly what I meant but I see that I should define my problem in
more details - How can I recognize that IRP_MJ_SET_INFORMATION of class
FileRenameInformation moves a directory to the Recycle Bin but not just
renames it really? Actualy I assume in my driver that if a directory or a
file is in the Recycle Bin then it is deleted.
Thank you all of you and especially Rob!
Jack
From: Rob Fuller
>Reply-To: “File Systems Developers”
>To: “File Systems Developers”
>Subject: [ntfsd] RE: Recognize when IRP_MJ_SET_INFORMATION
>(RenameInfo rmat ion) deletes a directory
>Date: Fri, 14 Apr 2000 17:56:16 -0500
>
>In general, when you “delete” a file or directory through Explorer, the
>file
>is renamed into the Recycle Bin directory. This corresponds to an
>IRP_MJ_SET_INFORMATION of class FileRenameInformation. When you empty the
>recycle bin, the file is really deleted, which corresponds to an
>IRP_MJ_SET_INFORMATION of class FileDispositionInformation.
>
>If you have configured your recycle bin not to collect “deleted” files,
>then
>the file is really deleted, instead of renamed into the recycle bin. This
>corresponds to an IRP_MJ_SET_INFORMATION of class
>FileDispositionInformation.
>
>When you delete a file or directory from the command line, it is never
>placed in the recycle bin. Instead it is deleted with an
>IRP_MJ_SET_INFORMATION of class FileDispositionInformation.
>
>Does this help?
>
> > -----Original Message-----
> > From: COX,DAVID (HP-Roseville,ex1) [mailto:david_cox2@hp.com]
> > Sent: Friday, April 14, 2000 4:53 PM
> > To: File Systems Developers
> > Subject: [ntfsd] RE: Recognize when IRP_MJ_SET_INFORMATION (RenameInfo
> > rmat ion) deletes a directory
> >
> >
> > How would that make any sense?
> > I just tried this, and watched with sysinternals’ FileMon.
> > Given the empty
> > directory:
> >
> > “d:\test\delete_me”
> >
> > I ran the command
> >
> > d:\test> rmdir delete_me
> >
> > And here’s the FileMon trace:
> >
> > 4 2:29:28 PM cmd.exe IRP_MJ_CREATE D:\test\delete_me
> > SUCCESS Attributes:0000 Options:01000021
> > 5 2:29:28 PM cmd.exe IRP_MJ_SET_INFORMATION D:\test\delete_me
> > SUCCESS FileDispositionInformation
> > 6 2:29:28 PM cmd.exe IRP_MJ_CLEANUP D:\test\delete_me
> > SUCCESS
> > 7 2:29:28 PM cmd.exe IRP_MJ_CLOSE D:\test\delete_me
> > SUCCESS
> >
> > --------------------------------------------------------------
> > ---------
> > Dave Cox
> > Hewlett-Packard Co.
> > HPSO/SSMO (Santa Barbara)
> > https://ecardfile.com/id/Dave+Cox
> >
> >
> > -----Original Message-----
> > From: Jack Brown [mailto:xxxxx@hotmail.com]
> > Sent: Friday, April 14, 2000 1:57 AM
> > To: File Systems Developers
> > Subject: [ntfsd] RE: Recognize when IRP_MJ_SET_INFORMATION
> > (RenameInformat ion) deletes a directory
> >
> >
> > FileDispositionInformation is used only for files.
> > If you delete an empty directory it is done by FileRenameInformation.
> >
> > >From: “COX,DAVID (HP-Roseville,ex1)” <david_cox2>
> > >Reply-To: “File Systems Developers”
> > >To: “File Systems Developers”
> > >Subject: [ntfsd] RE: Recognize when IRP_MJ_SET_INFORMATION
> > >(RenameInformat ion) deletes a directory
> > >Date: Thu, 13 Apr 2000 10:17:25 -0700
> > >
> > >Why would it use FileRenameInformation to effect a directory delete?
> > >
> > >How about FileDispositionInformation, with the struct
> > >
> > > FILE_DISPOSITION_INFORMATION
> > > {
> > > BOOLEAN DeleteFile;
> > > }
> > >
> > >-------------------------------------------------------------
> > ----------
> > >Dave Cox
> > >Hewlett-Packard Co.
> > >HPSO/SSMO (Santa Barbara)
> > >https://ecardfile.com/id/Dave+Cox
> > >
> > >
> > >-----Original Message-----
> > >From: Jack Brown [mailto:xxxxx@hotmail.com]
> > >Sent: Thursday, April 13, 2000 5:00 AM
> > >To: File Systems Developers
> > >Subject: [ntfsd] Recognize when IRP_MJ_SET_INFORMATION
> > >(RenameInformation) deletes a directory
> > >
> > >
> > >I want to recognize the moment when FSD deletes a directory.
> > I found that
> > >it
> > >
> > >is done by IRP_MJ_SET_INFORMATION (FileRenameInformation). I
> > have a file
> > >system filter and in its completeion routine I am trying to find when
> > >exactly a directory has been deleted.
> > >One of the parameters that I have to examine is
> > ReplaceIfExists. I think it
> > >should be set to TRUE. But is it enough to assume that the
> > directory is
> > >deleted?
> > >
> > >Thanks
> > >Jack
> > >
> > >Get Your Private, Free Email at http://www.hotmail.com
> > >
> > >
> > >—
> > >You are currently subscribed to ntfsd as: david_cox2@hp.com
> > >To unsubscribe send a blank email to $subst(‘Email.Unsub’)
> > >
> > >—
> > >You are currently subscribed to ntfsd as: xxxxx@hotmail.com
> > >To unsubscribe send a blank email to $subst(‘Email.Unsub’)
> > >
> >
> >_
> > Get Your Private, Free Email at http://www.hotmail.com
> >
> >
> > —
> > You are currently subscribed to ntfsd as: david_cox2@hp.com
> > To unsubscribe send a blank email to $subst(‘Email.Unsub’)
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@nsisw.com
> > To unsubscribe send a blank email to $subst(‘Email.Unsub’)
> >
>
>—
>You are currently subscribed to ntfsd as: xxxxx@hotmail.com
>To unsubscribe send a blank email to $subst(‘Email.Unsub’)
>
______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com</david_cox2>