Transacted file delete

NTFSD
1

i’m looking for delete file operation in transacted File operation.
i getting notify on IRP_MJ_CREATE with FILE_DELETE_ON_CLOSE condition but file still exist and when i into COMMIT and delete file happen i can’t get notification,
how can monitor this operation?
thank you all,

2

You get given the transaction when the file is opened. Never done it myself, but I would imagine that you have to enlist in the transaction

1 Like
3

Thank you
I’m Reading Microsoft Sample code .
This code is complicated.
and i have another problems,
i wanna copy file into another location BUT my issue is when i must do copy?
if USER have’t access to a deleting file so file never deleted and PreCreate not realiable solution.
other prespective is postCreate File has been deleted.