Detect FILE_DELETE_ON_CLOSE Problem

NTFSD
1

Hi,Experts

I try to detect the flag FILE_DELETE_ON_CLOSE in IRP_MJ_CREATE ,

My code like the following:

if( IrpSp->Parameters.Create.Options & FILE_DELETE_ON_CLOSE )
{
KdPrint((" delete the file on close flag = %wZ \n",&FileObject->FileName));
}

I delete the files, but I never get the print , even i try this in the
completion routine.

Anyone can help ?

Thanks

Bin

2

It is not always to delete a file by specifying that flag when the file is
opened.
ZwSetInformationFile or its IRP can be used to delete files.

“Bin Zeng” wrote in message news:xxxxx@ntfsd…
> Hi,Experts
>
> I try to detect the flag FILE_DELETE_ON_CLOSE in IRP_MJ_CREATE ,
>
> My code like the following:
>
> if( IrpSp->Parameters.Create.Options & FILE_DELETE_ON_CLOSE )
> {
> KdPrint((" delete the file on close flag = %wZ
> \n",&FileObject->FileName));
> }
>
> I delete the files, but I never get the print , even i try this in the
> completion routine.
>
> Anyone can help ?
>
> Thanks
>
> Bin
>
>
>
>