Deleting a file!

NTFSD
1

Hi All,

When a file is deleted (both delete and shift+delete ), will my filter
driver get notified abt the deletion?

How to handle this case?

Wih Regards,
A.Ilamparithi.

2

I have not got access to my source at the moment but from what I remember it
is through the Set Information. A delete can be seen as a move to recycle
bin and a shift delete comes through as a delete. Be careful that the shift
delete sets a delete on close flag and can come through as an undelete so do
not do anything until the file handle is closed.

Hope this helps

Paul Delivett

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of A.Ilamparithi
Sent: Friday, 16 July 2004 06:52 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Deleting a file!

Hi All,

When a file is deleted (both delete and shift+delete ), will my filter
driver get notified abt the deletion?

How to handle this case?

Wih Regards,
A.Ilamparithi.

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@delivett.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Paul Delivett wrote:

I have not got access to my source at the moment but from what I remember it
is through the Set Information. A delete can be seen as a move to recycle
bin and a shift delete comes through as a delete. Be careful that the shift
delete sets a delete on close flag and can come through as an undelete so do
not do anything until the file handle is closed.

Hope this helps

Paul Delivett

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of A.Ilamparithi
Sent: Friday, 16 July 2004 06:52 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Deleting a file!

Hi All,

When a file is deleted (both delete and shift+delete ), will my filter
driver get notified abt the deletion?

How to handle this case?

Wih Regards,
A.Ilamparithi.

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@delivett.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

for real delete (shift+delete) i think you should check
IRP_MJ_SET_INFORMATION in your filter dispatch routine.
Specifically,Irp->Parameters-SetFile->FileInformationClass ==
FileDispositionInformation. For delete (move to recycle bin), this is
not a real delete but a rename, so FileRenameInformation. In this case
you should check if the RootDirectory handle of FILE_RENAME_INFORMATION
points to the recycle bin dir (via ObReferenceObjectByHandle,checking
the FileName).
Alternatively, if the file is going to be deleted you could check
FileObject->DeletePending.

Hope this helps,
Valerio