Deleting file by ID

NTFSD
1

I admit that it is kinda bizarre what I am doing, but I found out that a file cannot be deleted by ID. Is that a bug of feature?

The below code returns STATUS_SUCCESS, but the file is still there.
OS: Win7, App: Usermode

// Open the file for delete access
Status = NtOpenFile(&FileHandle,
DELETE,
ObjAttr,
&IoStatus,
FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
FILE_DELETE_ON_CLOSE | FILE_OPEN_BY_FILE_ID);
if(NT_SUCCESS(Status))
{
NtClose(FileHandle);
return STATUS_SUCCESS;
}

I tried to reproduce with FileTest, I get the same result. Opening and closing the file works fine, attempt to NtSetInformationFile(FileDispositionInformation) fails with STATUS_INVALID_PARAMETER.

The file is C:\FileToDelete.txt, parent directory was open with ??\C:.

2

Hi Ladislav,

There is blog post that touches on the issue: Some Limitations Using Files Opened By ID. http://fsfilters.blogspot.com/2012/03/some-limitations-using-files-opened-by.html.

Thanks,
Alex.

3

Bear in mind that deleting a file in the NT model is a side-effect of removing all its names; delete is an intention, not an operation. You mark a file's name for delete. If the name is still marked for delete when the last open handle to it cleans up, then the name is deleted. If the name is the last name (i.e. link) for the file, then the file is also deleted.

From this it follows that you cannot delete a file using an open-by-ID handle, because you haven't associated the handle with any of the file's names.

Christian [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.

4

Ok, that makes sense. Thanks for the answers.