Corrupted Recycle Bin

What causes explorer to display the message
“The Recycle Bin is corrupt or invalid”

I’ve been looking at filemon and ‘strace’ logs
from explorer, but I’m not sure why explorer gives
this message when deleting files from our FSD.

Peter,

After the file has been renamed to the recycler, Explorer performs some
queries on the renamed file. I am guessing that it does this to ensure the
file was correctly renamed. Maybe there is some mismatch happening here in
the file information or something? I would check what Explorer is querying
for after it renames the file and ensure that the information is the same
pre and post rename.

Pete

Peter Scott
xxxxx@KernelDrivers.com
www.KernelDrivers.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Peter Lawthers
Sent: Tuesday, April 27, 2004 10:28 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Corrupted Recycle Bin

What causes explorer to display the message
“The Recycle Bin is corrupt or invalid”

I’ve been looking at filemon and ‘strace’ logs
from explorer, but I’m not sure why explorer gives
this message when deleting files from our FSD.


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

One possible reason for such behavior is failure to “undo deletion” in
response for IRP_MJ_SET_INFORMATION/FileDispositionInformation when
DeleteFile is set to false. Explorer checks if the file is eligible for
deletion by sending FileDispositionInformation with DeleteFile set to true
followed FileDispositionInformation with DeleteFile set to false if the
first call succeeds.

Alexei.

“Peter Lawthers” wrote in message news:xxxxx@ntfsd…
> What causes explorer to display the message
> “The Recycle Bin is corrupt or invalid”
>
> I’ve been looking at filemon and ‘strace’ logs
> from explorer, but I’m not sure why explorer gives
> this message when deleting files from our FSD.
>
>
>

The odd part is that I get the message *before* the rename.
That’s why I was wondering what would trigger this. This can
happen on the first deletion of a virgin filesystem.

Accckkk – I just discovered it only happens if I enable
ACL support so it’s probably something buried in the land
of security. Blech.

Any hints appreciated.

Alexei Jelvis wrote:

One possible reason for such behavior is failure to “undo deletion” in
response for IRP_MJ_SET_INFORMATION/FileDispositionInformation when
DeleteFile is set to false. Explorer checks if the file is eligible for
deletion by sending FileDispositionInformation with DeleteFile set to true
followed FileDispositionInformation with DeleteFile set to false if the
first call succeeds.

Alexei.

“Peter Lawthers” wrote in message news:xxxxx@ntfsd…
>
>>What causes explorer to display the message
>> “The Recycle Bin is corrupt or invalid”
>>
>>I’ve been looking at filemon and ‘strace’ logs
>>from explorer, but I’m not sure why explorer gives
>>this message when deleting files from our FSD.
>>
>>
>>
>
>
>
>
> —
> Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@adic.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

Peter,

I think explorer checks the security descriptor for the recycle bin when
the recycle bin is opened. If the SD does not match the default template
(permissions for user, admin, and system), it displays a message that
the recycle bin is corrupt.

Could you make sure you are not failing this security check?

Thanks
Ravinder

This posting is provided “AS IS” with no warranties, and confers no
rights.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Peter Lawthers
Sent: Wednesday, April 28, 2004 11:46 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] Corrupted Recycle Bin

The odd part is that I get the message *before* the rename.
That’s why I was wondering what would trigger this. This can
happen on the first deletion of a virgin filesystem.

Accckkk – I just discovered it only happens if I enable
ACL support so it’s probably something buried in the land
of security. Blech.

Any hints appreciated.

Alexei Jelvis wrote:

One possible reason for such behavior is failure to “undo deletion” in
response for IRP_MJ_SET_INFORMATION/FileDispositionInformation when
DeleteFile is set to false. Explorer checks if the file is eligible
for
deletion by sending FileDispositionInformation with DeleteFile set to
true
followed FileDispositionInformation with DeleteFile set to false if
the
first call succeeds.

Alexei.

“Peter Lawthers” wrote in message news:xxxxx@ntfsd…
>
>>What causes explorer to display the message
>> “The Recycle Bin is corrupt or invalid”
>>
>>I’ve been looking at filemon and ‘strace’ logs
>>from explorer, but I’m not sure why explorer gives
>>this message when deleting files from our FSD.
>>
>>
>>
>
>
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@adic.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

My ‘recycle’ directory has only one entry in the
security descriptor (for everyone) with all access allowed.
However, with the exception of the control word in
the Security Descriptor, it matches the security descriptor
for my root drive exactly (8004 for root, 8c04 for me,
extra bits say sacl and dacl are inherited). Does explorer
expect explicit values for the control word?

The other thing that is odd is that after the first
complaint, explorer will delete further items without a problem.
The recycle bin looks fine, and I can restore files
from the recycle bin without a problem.

Confused.

Ravinder Thind wrote:

Peter,

I think explorer checks the security descriptor for the recycle bin when
the recycle bin is opened. If the SD does not match the default template
(permissions for user, admin, and system), it displays a message that
the recycle bin is corrupt.

Could you make sure you are not failing this security check?

Thanks
Ravinder