Good day everyone !
i need to wipe files before they deleted from MFT.
Most reliable and documented way i can think about - clear delete on
close flag and wait for stream context cleanup callback, open file,
wipe and delete. However, stream context cleanup callback can and most
likely will be called after 5, 10 and even more minutes after
IRP_MJ_CLEANUP and _CLOSE. During all this time it is possible to open
file.
Is there some other way to detect the moment when memory and cache
manager doesn’t use file ?
Thanks
On 3/22/2010 11:47 AM, sergey pisarev wrote:
Good day everyone !
i need to wipe files before they deleted from MFT.
Most reliable and documented way i can think about - clear delete on
close flag and wait for stream context cleanup callback, open file, wipe
and delete. However, stream context cleanup callback can and most likely
will be called after 5, 10 and even more minutes after IRP_MJ_CLEANUP
and _CLOSE. During all this time it is possible to open file.
How about just ‘wiping’ the file when you receive the pre-cleanup
callback for a deleted file? The file will not be deleted by the file
system until the last open handle on the file is closed and the delete
actually occurs during cleanup processing. If the file is marked for
deletion, then any paging which occurs after the cleanup will be
rejected by the file system, if you look through the source for the
FastFat file system you can see this.
Pete
Is there some other way to detect the moment when memory and cache
manager doesn’t use file ?
Thanks
NTFSD is sponsored by OSR
For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar)
visit:http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295
Peter, thank you very much !!
Shame on me, i didn’t know about paging I/O rejection after CLEANUP
On Mar 23, 2010, at 12:44 AM, Peter Scott wrote:
On 3/22/2010 11:47 AM, sergey pisarev wrote:
> Good day everyone !
>
> i need to wipe files before they deleted from MFT.
> Most reliable and documented way i can think about - clear delete on
> close flag and wait for stream context cleanup callback, open file,
> wipe
> and delete. However, stream context cleanup callback can and most
> likely
> will be called after 5, 10 and even more minutes after IRP_MJ_CLEANUP
> and _CLOSE. During all this time it is possible to open file.
>
How about just ‘wiping’ the file when you receive the pre-cleanup
callback for a deleted file? The file will not be deleted by the
file system until the last open handle on the file is closed and the
delete actually occurs during cleanup processing. If the file is
marked for deletion, then any paging which occurs after the cleanup
will be rejected by the file system, if you look through the source
for the FastFat file system you can see this.
Pete
> Is there some other way to detect the moment when memory and cache
> manager doesn’t use file ?
>
> Thanks
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars
> (including our new fs mini-filter seminar)
> visit:http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295
NTFSD is sponsored by OSR
For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit: http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
On 3/22/2010 5:00 PM, sergey pisarev wrote:
Peter, thank you very much !!
Shame on me, i didn’t know about paging I/O rejection after CLEANUP
Yeah, the FastFat source is great for this type of general
functionality. While it’s not NTFS it does allow you ‘some’ insight into
the thinking behind NTFS.
Pete
–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295