Detecting DeletePending in Cleanup

If one opens a file with DELETE_ON_CLOSE does a IRP_MJ_SET_INFORMATION get created during the close process ?

If not is there a way to detect a DeletePending in IRP_MJ_CLEANUP ?
A minifilter code fragment would be great!

> If one opens a file with DELETE_ON_CLOSE does a IRP_MJ_SET_INFORMATION get

created during the close process ?

No…

If not is there a way to detect a DeletePending in IRP_MJ_CLEANUP ?

Some filesystems set FO_DELETE_ON_CLOSE in FileObject->Flags. Some don’t.

A minifilter code fragment would be great!

No fragment I’m afraid. The correct way to do this is to setup a stream
handle (which you’ll probably need so that you know when the file is really
going away) and set a flag in it. As a quick and dirty, you might want to
try setting FO_DELETE_ON_CLOSE in post create if the underlying fsd doesn’t.

Rod

Well here is another interesting topic in the limits of filter drivers :slight_smile:

If one opens a file with DELETE_ON_CLOSE does a IRP_MJ_SET_INFORMATION get
created during the close process ?

Nope

If not is there a way to detect a DeletePending in IRP_MJ_CLEANUP ?

Nope

Imagine you have seen IRP_MJ_CLEANUP in your pre operation but have not seen
in your post operation. So now along comes
IRP_MJ_SET_INFORMATION/FileDispositionInformation which you see in your pre
operation.

Now in which order do these arrive at the FSD and moreover in which order
are these proceseed in the FSD? What is the effect of the different possible
orders? Can you tell from your filter driver (fliter manager or so called
legacy) whether the file^H^H^H^Hlink (!) or stream (!!) will be / has been
deleted?

wrote in message news:xxxxx@ntfsd…
> If one opens a file with DELETE_ON_CLOSE does a IRP_MJ_SET_INFORMATION get
> created during the close process ?
>
> If not is there a way to detect a DeletePending in IRP_MJ_CLEANUP ?
> A minifilter code fragment would be great!
>
>
>

> If one opens a file with DELETE_ON_CLOSE does a

IRP_MJ_SET_INFORMATION get created during the close process ?

No.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com