Hi,
In a file system filter driver on Windows 2000 how to differentiate between
DELETE and SHIFT+DELETE.
I was thinking that just DELETE will be move operation but I see
FileDispositionInformation coming for the file on which we do DELETE.
Any information is helpful.
Thanks,
Kedar.
In a file system filter driver, you differentiate between rename and delete
operations.
If you want to differentiate between DELETE and SHIFT+DELETE, write a
keyboard filter.
At 07:30 PM 6/23/2005 +0530, you wrote:
Hi,
In a file system filter driver on Windows 2000 how to differentiate between
DELETE and SHIFT+DELETE.I was thinking that just DELETE will be move operation but I see
FileDispositionInformation coming for the file on which we do DELETE.Any information is helpful.
Thanks,
Kedar.
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17You are currently subscribed to ntfsd as: xxxxx@privtek.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
Dan,
Delete sends your files to the recycle bin, and thus permits to restore the
files later. Shift-delete removes them permanently. Hence the file system
operation should be somewhat different, isn’t it?
Best regards,
David Burg
David Burg
Software Development
Subject: Re: differentiating between DELETE and SHIFT+DELETE
From: Dan Kyler
Date: Thu, 23 Jun 2005 08:13:55 -0600
X-Message-Number: 13
In a file system filter driver, you differentiate between rename and delete
operations.
If you want to differentiate between DELETE and SHIFT+DELETE, write a
keyboard filter.
- Dan.
At 07:30 PM 6/23/2005 +0530, you wrote:
>Hi,
>
>In a file system filter driver on Windows 2000 how to differentiate between
>DELETE and SHIFT+DELETE.
>
>I was thinking that just DELETE will be move operation but I see
>FileDispositionInformation coming for the file on which we do DELETE.
>
>
>Any information is helpful.
>
>Thanks,
>Kedar.
>
>
>
>—
>Questions? First check the IFS FAQ at
>https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: xxxxx@privtek.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com
>Delete sends your files to the recycle bin, and thus permits to restore the
files later. Shift-delete removes them permanently. Hence the file system
operation should be somewhat different, isn’t it?
In explorer this is generally true, but I think the default actions can be
changed.
Explorer is not part of the file system. Pressing the DELETE key in
explorer is not a file system operation.
File system filters deal with file system operations. Trying to associate
a file system operation with a particular user action is a lost cause.
Dan,
Delete sends your files to the recycle bin, and thus permits to restore the
files later. Shift-delete removes them permanently. Hence the file system
operation should be somewhat different, isn’t it?Best regards,
David Burg
David Burg
Software DevelopmentNero AG
Im Stoeckmaedle 18 fax: +49 (0)7248 928 299
76307 Karlsbad email: xxxxx@nero.com
Germany http://www.nero.com
Subject: Re: differentiating between DELETE and SHIFT+DELETE
From: Dan Kyler
>Date: Thu, 23 Jun 2005 08:13:55 -0600
>X-Message-Number: 13
>
>In a file system filter driver, you differentiate between rename and delete
>operations.
>
>If you want to differentiate between DELETE and SHIFT+DELETE, write a
>keyboard filter.
>
>- Dan.
>
>At 07:30 PM 6/23/2005 +0530, you wrote:
> >Hi,
> >
> >In a file system filter driver on Windows 2000 how to differentiate between
> >DELETE and SHIFT+DELETE.
> >
> >I was thinking that just DELETE will be move operation but I see
> >FileDispositionInformation coming for the file on which we do DELETE.
> >
> >
> >Any information is helpful.
> >
> >Thanks,
> >Kedar.
> >
> >
> >
> >—
> >Questions? First check the IFS FAQ at
> >https://www.osronline.com/article.cfm?id=17
> >
> >You are currently subscribed to ntfsd as: xxxxx@privtek.com
> >To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>—
>Questions? First check the IFS FAQ at
>https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: xxxxx@privtek.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com
> File system filters deal with file system operations. Trying to associate
a file system operation with a particular user action is a lost cause.
This is true.
Unfortunately, company management usually does not know this,
and I must solve their development tasks like
“Could the driver do something for the normal rename and
something else for rename to recycle bin ?”
I must not writet here here how difficult is to explain to them that the
filter
driver does not see any rename to recycle bin, it doesn’t even know
that something like recycle bin exists. Principles, schemas, FS rules,
anything does not work. “We need it”, I’ll hear as the final argument.
The other “tasks” are related to drive letters, often discussed here.
“Well, if the file is D:\SomeDir\SomeFile.exe, do something special”,
I hear, “this will not take long time to implement, right ?”.
Hard to explain that the driver should not know anything about
the drive letters, hard to explain that there may be a mount points,
because “Most of our customers don’t use them”.
This is hard life of a driver writer from another point of view … :-))
L.
Hi,
I have tested the steps that happen when DELETE button is pressed on a file
with filemon. The log is as below:
I have filtered the IRP_MJ_CREATE:READ:DIRECTORY_CONTROL and other unwanted
messages.
I was surprised to see Dispositon information first and then rename
information. Should it not happen the other way. I was thinking that the
file gets written to recyclebin first and then the actual file gets deleted.
Could any one tell me why it would have been designed like that and the
advantage over that.
Thanks,
Kedar.
Hi,
I have tested the steps that happen when DELETE button is pressed on a file
with filemon. Log file is attached.
I have filtered the IRP_MJ_CREATE:READ:DIRECTORY_CONTROL and other unwanted
messages.
I was surprised to see Dispositon information first and then rename
information. Should it not happen the other way. I was thinking that the
file gets written to recyclebin first and then the actual file gets deleted.
Could any one tell me why it would have been designed like that and the
advantage over that.
Thanks,
Kedar.
begin 666 deletelog.txt
M,0DQ.C0V.C Q(%!-"65X<&QOM3U)-051)3TX@"4,Z7$UUM5FEV92!,92!2;VDA7# T("xxxxx@16YI9VUA("T@0F5Y;VYD(%1H92!);G9IM;&4N;7 S"5-50T-%4U,)1FEL941IM"3$Z-#8Z,#$@4$T)97AP;&]R97(N97AE.C$P-38)25)07TU7U-%5%])3D9/
M4DU!5$E/3B )0SI<375S:6-<16YI9VUA(“T@3&xxxxx@4F]I($5S=”!-;W)T+“!6
M:79E($QE(%)O:2%<,#0@+2!%;FEG;6$@+2!“97EO;xxxxx@5&AE($EN=FES:6)L
M92YM<#,)4U5#0T534PE&:6QE1&ES<&]S:71I;VY);F9OM,3HT-CHP,2!030EE>'!L;W)E&4Z,3 U-@E)4E!?34I?4T547TE.1D]2
M34%424].( E#.EQ-=7-I8UQ%;FEG;6$@+2!,92!2;VD@17-T($UOM=F4@3&xxxxx@4F]I(5PP-” M($5N:6=M82 M($)E>6]N9”!4:&xxxxx@26YV:7-I8FQE
M+FUP,PE354-#15-3"49I;&5296YA;65);F9OM,2!030EE>‘!L;W)E&4Z,3 U-@E)4E!?34I?5U))5$4@"4,Z7%)E8WEC
M;&5D7$E.1D\R"5-50T-%4U,)3V9F<v5t.b q r.>M#0HU"3$Z-#8Z,#$@4$T)97AP;&]R97(N97AE.C$P-38)1D%35$E/7T1%5DE#
M15]#3TY44D],"4,Z7%)E8WEC;&5D7$1#-34)1D%)3%5210E)3T-43#H@,’@T
M1# P,#@)#0HV"3$Z-#8Z,#$@4$T)97AP;&]R97(N97AE.C$P-38)25)07TU
M7T1%5DE#15]#3TY44D],“4,Z7%)E8WEC;&5D7$1#-34)24Y604Q)1”!005)!
M345415()24]#5$PZ(#!X-$0P,# X"0T*-PDQ.C0V.C Q(%!-"65X<&QOM+F5X93HQ,#4V"4930U1,7T=%5%]215!!4E-%7U!/24Y4"4,Z7%)E8WEC;&5D
M7$1#-35<"4E.5D%,240@1$5624-%(%)%455%4U0)"0T*. DQ.C0V.C Q(%!-
M"65X<&QOM96-Y8VQE9 E&04E,55)%“4E/0U1,.B P>#1$,# P. D-“CD),3HT-CHP,2!0
M30EE>'!L;W)E&4Z,3 U-@E)4E!?34I?1$5624-%7T-/3E123TP)0SI<
M4F5C>6-L960)24Y604Q)1”!005)!345415()24]#5$PZ(#!X-$0P,# X"0T*
M,3 ),3HT-CHP,2!030EE>'!L;W)E&4Z,3 U-@E&4T-43%]'151?4D50
M05)315]03TE.5 E#.EQ296-Y8VQE9%P)24Y604Q)1”!$159)0T4@4D515453
M5 D)#0HQ,0DQ.C0V.C Q(%!-"65X<&QOM159)0T5?0T].5%)/3 E#.EQ296-Y8VQE9%Q$0S4V"49!24Q54D4)24]#5$PZ
M(#!X-$0P,# X"0T*,3(),3HT-CHP,2!030EE>‘!L;W)E&4Z,3 U-@E)
M4E!?34I?1$5624-%7T-/3E123TP)0SI<4F5C>6-L961<1$,U-@E)3E9!3$E$
M(%!!4D%-151%4@E)3T-43#H@,’@T1# P,#@)#0HQ,PDQ.C0V.C Q(%!-"65X
M<&QOM8WEC;&5D7$1#-39<"4E.5D%,240@1$5624-%(%)%455%4U0)"0T*,30),3HT
M-CHP,2!030EE>‘!L;W)E&4Z,3 U-@E&05-424]?1$5624-%7T-/3E12
M3TP)0SI<4F5C>6-L960)1D%)3%5210E)3T-43#H@,’@T1# P,#@)#0HQ-0DQ
M.C0V.C Q(%!-"65X<&QOM5%)/3 E#.EQ296-Y8VQE9 E)3E9!3$E$(%!!4D%-151%4@E)3T-43#H@,'@T
M1# P,#@)#0HQ-@DQ.C0V.C Q(%!-"65X<&QOM7T=%5%]215!!4E-%7U!/24Y4"4,Z7%)E8WEC;&5D7 E)3E9!3$E$($1%5DE#
M12!215%515-4"0D-"C$W"3$Z-#8Z,#(@4$T)4WES=&5M.C@)25)07TU7U=2
M251%@E#.EQ296-Y8VQE9%Q)3D9/,@E354-#15-3"4]F9G-E=#H@,3(V.3M($QE;F=T:#H@-# Y-@D-“C$X"3$Z-#8Z,#(@4$T)4WES=&5M.C@)25)07TU*
M7U-%5%])3D9/4DU!5$E/3BH)0SI<4F5C>6-L961<24Y&3S()4U5#0T534PE&
M:6QE16YD3V9&:6QE26YF;W)M871I;VX)#0HQ.0DQ.C0V.C$X(%!-“5-YM;3HX"4E24%]-2E]74DE412H)0SI<375S:6-<16YI9VUA(“T@3&xxxxx@4F]I($5S
M=”!-;W)T+”!6:79E($QE(%)O:2$)4U5#0T534PE/9F9S970Z(# @3&5N9W1H
M.B T,#DV"0T*,C ),3HT-CHQ.”!030E3>7-T96TZ. E)4E!?34I?5U))5$4J
M"4,Z"5-50T-%4U,)3V9F<v5t.b q-c>M.C0V.C$X(%!-“5-Y6-L960)
M4U5#0T534PE/9F9S970Z(# @3&5N9W1H.B T,#DV"0T*,C(),3HT-CHQ.”!0
M30E3>7-T96TZ. E)4E!?34I?5U))5$4J"4,Z7%)E8WEC;&5D"5-50T-%4U,)
M3V9F<v5t.b q>MM($QE;F=T:#H@-# Y-@D-"C(T"3$Z-3 Z-#,@4$T)1DE,14U/3BY%6$4Z,3M-@E&4T-43%])4U]63TQ5345?34]53E1%1 E#.EQF:6QE;6]N7$YE=R!F:6QE
M;6]N7$5815Q214Q%05-%"5-50T-%4U,)"0T*,C4),3HU,#HT,R!030E&24Q%
M34].+D5813HQ-S4V"4930U1,7TE37U9/3%5-15]-3U5.5$5$"4,Z7&9I;&5M
M;VY<3F5W(&9I;&5M;VY<15A%7%)%3$5!4T4)4U5#0T534PD)#0HR-@DQ.C4P
M.C0S(%!-"49)3$5-3TXN15A%.C$W-38)1E-#5$Q?25-?5D],54U%7TU/54Y4
M140)0SI<9FEL96UO;EQ.97<@9FEL96UO;EQ%6$5<4D5,14%310E354-#15-3
M"0D-"C(W"3$Z-3 Z-#,@4$T)1DE,14U/3BY%6$4Z,3M3TQ5345?34]53E1%1 E#.EQF:6QE;6]N7$YE=R!F:6QE;6]N7$5815Q214Q%
M05-%"5-50T-%4U,)"0T*,C@),3HU,#HT,R!030E&24Q%34].+D5813HQ-S4V
M"4930U1,7TE37U9/3%5-15]-3U5.5$5$"4,Z7&9I;&5M;VY<3F5W(&9I;&5M
M;VY<15A%7%)%3$5!4T4)4U5#0T534PD)#0HR.0DQ.C4P.C0S(%!-"49)3$5-
M3TXN15A%.C$W-38)1E-#5$Q?25-?5D],54U%7TU/54Y4140)0SI<9FEL96UO
M;EQ.97<@9FEL96UO;EQ%6$5<4D5,14%310E354-#15-3"0D-"C,P"3$Z-3 Z
M-#,@4$T)1DE,14U/3BY%6$4Z,3M1 E#.EQF:6QE;6]N7$YE=R!F:6QE;6]N7$5815Q214Q%05-%"5-50T-%4U,)
M"0T*,S$),3HU,#HT,R!030E&24Q%34].+D5813HQ-S4V"4930U1,7TE37U9/
M3%5-15]-3U5.5$5$"4,Z7&9I;&5M;VY<3F5W(&9I;&5M;VY<15A%7%)%3$5!
M4T4)4U5#0T534PD)#0HS,@DQ.C4P.C0S(%!-"49)3$5-3TXN15A%.C$W-38)
M1E-#5$Q?25-?5D],54U%7TU/54Y4140)0SI<9FEL96UO;EQ.97<@9FEL96UO
M;EQ%6$5<4D5,14%310E354-#15-3"0D-"C,S"3$Z-3 Z-#,@4$T)1DE,14U/
M3BY%6$4Z,3M7$YE=R!F:6QE;6]N7$5815Q214Q%05-%"5-50T-%4U,)"0T*,S0),3HU,#HT
M,R!030E&24Q%34].+D5813HQ-S4V"4930U1,7TE37U9/3%5-15]-3U5.5$5$
M"4,Z7&9I;&5M;VY<3F5W(&9I;&5M;VY<15A%7%)%3$5!4T4)4U5#0T534PD)
M#0HS-0DQ.C4P.C0S(%!-"49)3$5-3TXN15A%.C$W-38)1E-#5$Q?25-?5D],
M54U%7TU/54Y4140)0SI<9FEL96UO;EQ.97<@9FEL96UO;EQ%6$5<4D5,14%3
M10E354-#15-3"0D-"C,V"3$Z-3 Z-#,@4$T)1DE,14U/3BY%6$4Z,3M4T-43%])4U]63TQ5345?34]53E1%1 E#.EQF:6QE;6]N7$YE=R!F:6QE;6]N
M7$5815Q214Q%05-%"5-50T-%4U,)"0T*,S<),3HU,#HT,R!030E&24Q%34].
M+D5813HQ-S4V"4930U1,7TE37U9/3%5-15]-3U5.5$5$"4,Z7&9I;&5M;VY<
M3F5W(&9I;&5M;VY<15A%7%)%3$5!4T4)4U5#0T534PD)#0HS. DQ.C4P.C0S
M(%!-"49)3$5-3TXN15A%.C$W-38)1E-#5$Q?25-?5D],54U%7TU/54Y4140)
M0SI<9FEL96UO;EQ.97<@9FEL96UO;EQ%6$5<4D5,14%310E354-#15-3"0D-
M"C,Y"3$Z-3 Z-#,@4$T)1DE,14U/3BY%6$4Z,3M345?34]53E1%1 E#.EQF:6QE;6]N7$YE=R!F:6QE;6]N7$5815Q214Q%05-%
M"5-50T-%4U,)"0T*-# ),3HU,#HT,R!030E&24Q%34].+D5813HQ-S4V"493
M0U1,7TE37U9/3%5-15]-3U5.5$5$"4,Z7&9I;&5M;VY<3F5W(&9I;&5M;VY<
M15A%7%)%3$5!4T4)4U5#0T534PD)#0HT,0DQ.C4P.C0S(%!-"49)3$5-3TXN
M15A%.C$W-38)1E-#5$Q?25-?5D],54U%7TU/54Y4140)0SI<9FEL96UO;EQ.
M97<@9FEL96UO;EQ%6$5<4D5,14%310E354-#15-3"0D-"C0R"3$Z-3 Z-#,@
M4$T)1DE,14U/3BY%6$4Z,3M.EQF:6QE;6]N7$YE=R!F:6QE;6]N7$5815Q214Q%05-%"5-50T-%4U,)"0T*
M-#,),3HU,#HT,R!030E&24Q%34].+D5813HQ-S4V"4930U1,7TE37U9/3%5-
M15]-3U5.5$5$"4,Z7&9I;&5M;VY<3F5W(&9I;&5M;VY<15A%7%)%3$5!4T4)
M4U5#0T534PD)#0HT- DQ.C4P.C0S(%!-"49)3$5-3TXN15A%.C$W-38)1E-#
M5$Q?25-?5D],54U%7TU/54Y4140)0SI<9FEL96UO;EQ.97<@9FEL96UO;EQ%
M6$5<4D5,14%310E354-#15-3"0D-"C0U"3$Z-3 Z-#,@4$T)1DE,14U/3BY%
M6$4Z,3M=R!F:6QE;6]N7$5815Q214Q%05-%"5-50T-%4U,)"0T*-#8),3HU,#HT,R!0
M30E&24Q%34].+D5813HQ-S4V"4930U1,7TE37U9/3%5-15]-3U5.5$5$"4,Z
M7&9I;&5M;VY<3F5W(&9I;&5M;VY<15A%7%)%3$5!4T4)4U5#0T534PD)#0HT
M-PDQ.C4P.C0S(%!-"49)3$5-3TXN15A%.C$W-38)1E-#5$Q?25-?5D],54U%
M7TU/54Y4140)0SI<9FEL96UO;EQ.97<@9FEL96UO;EQ%6$5<4D5,14%310E3
M54-#15-3"0D-"C0X"3$Z-3 Z-#,@4$T)1DE,14U/3BY%6$4Z,3M3%])4U]63TQ5345?34]53E1%1 E#.EQF:6QE;6]N7$YE=R!F:6QE;6]N7$58
M15Q214Q%05-%"5-50T-%4U,)"0T*-#D),3HU,#HT,R!030E&24Q%34].+D58
M13HQ-S4V"4930U1,7TE37U9/3%5-15]-3U5.5$5$"4,Z7&9I;&5M;VY<3F5W
M(&9I;&5M;VY<15A%7%)%3$5!4T4)4U5#0T534PD)#0HU, DQ.C4P.C0S(%!-
M"49)3$5-3TXN15A%.C$W-38)1E-#5$Q?25-?5D],54U%7TU/54Y4140)0SI<
M9FEL96UO;EQ.97<@9FEL96UO;EQ%6$5<4D5,14%310E354-#15-3"0D-"C4Q
M"3$Z-3 Z-#,@4$T)1DE,14U/3BY%6$4Z,3M34]53E1%1 E#.EQF:6QE;6]N7$YE=R!F:6QE;6]N7$5815Q214Q%05-%"5-5
M0T-%4U,)"0T*-3(),3HU,#HT,R!030E&24Q%34].+D5813HQ-S4V"4930U1,
M7TE37U9/3%5-15]-3U5.5$5$"4,Z7&9I;&5M;VY<3F5W(&9I;&5M;VY<15A%
M7%)%3$5!4T4)4U5#0T534PD)#0HU,PDQ.C4P.C0S(%!-"49)3$5-3TXN15A%
M.C$W-38)1E-#5$Q?25-?5D],54U%7TU/54Y4140)0SI<9FEL96UO;EQ.97<@
M9FEL96UO;EQ%6$5<4D5,14%310E354-#15-3"0D-"C4T"3$Z-3 Z-#,@4$T)
M1DE,14U/3BY%6$4Z,3M:6QE;6]N7$YE=R!F:6QE;6]N7$5815Q214Q%05-%"5-50T-%4U,)"0T*-34)
M,3HU,#HT,R!030E&24Q%34].+D5813HQ-S4V"4930U1,7TE37U9/3%5-15]-
M3U5.5$5$"4,Z7&9I;&5M;VY<3F5W(&9I;&5M;VY<15A%7%)%3$5!4T4)4U5#
M0T534PD)#0HU-@DQ.C4P.C0S(%!-"49)3$5-3TXN15A%.C$W-38)1E-#5$Q?
M25-?5D],54U%7TU/54Y4140)0SI<9FEL96UO;EQ.97<@9FEL96UO;EQ%6$5<
M4D5,14%310E354-#15-3"0D-"C4W"3$Z-3 Z-#,@4$T)1DE,14U/3BY%6$4Z
M,3M:6QE;6]N7$5815Q214Q%05-%"5-50T-%4U,)"0T*-3@),3HU,#HT,R!030E&
M24Q%34].+D5813HQ-S4V"4930U1,7TE37U9/3%5-15]-3U5.5$5$"4,Z7&9I
M;&5M;VY<3F5W(&9I;&5M;VY<15A%7%)%3$5!4T4)4U5#0T534PD)#0HU.0DQ
M.C4P.C0S(%!-“49)3$5-3TXN15A%.C$W-38)1E-#5$Q?25-?5D],54U%7TU/
M54Y4140)0SI<9FEL96UO;EQ.97<@9FEL96UO;EQ%6$5<4D5,14%310E354-#
'15-3"0D-”@``
`
end</v5t.b></v5t.b></v5t.b>
If you really want to investigate the requests sent after
Delete or Shift+Delete, I recommend you to write
a small testprogram with DeleteFile() call and with
SHFileOperation (The API causing move file to recycle
Bin). The requests can be easier filtered by Filemon,
and you can learn from it. Then move “to the real world”
and watch Explorer activity. Starting with Explorer
without deep knowledge may be confusing.
L.
Step 1:
IRP_MJ_SET_INFORMATION is sent with
FileDispositionInformation and DeleteFile = TRUE.
This is used by Explorer to ask the file system “can I
delete this file ?” and to mark it for deletion.
If IRP_MJ_SET_INFORMATION is successful that means the
file can be deleted so Explorer can proceed to step 2.
Step 2:
IRP_MJ_SET_INFORMATION is sent with
FileDispositionInformation and DeleteFile = FALSE.
This is used by Explorer to unmark the file for
deletion, since it doesn’t want to file to actually be
deleted. Explorer wants to move it to recycle bin.
Step 3:
The file is moved to recycle bin using a rename
operation. That is why you see IRP_MJ_SET_INFORMATION
with FileRenameInformation.
Regards,
Razvan
— kedar wrote:
> Hi,
>
> I have tested the steps that happen when DELETE
> button is pressed on a file
> with filemon. Log file is attached.
>
> I have filtered the
> IRP_MJ_CREATE:READ:DIRECTORY_CONTROL and other
> unwanted
> messages.
>
>
> I was surprised to see Dispositon information first
> and then rename
> information. Should it not happen the other way. I
> was thinking that the
> file gets written to recyclebin first and then the
> actual file gets deleted.
>
> Could any one tell me why it would have been
> designed like that and the
> advantage over that.
>
> Thanks,
> Kedar.
>
>
____________________________________________________
Yahoo! Sports
Rekindle the Rivalries. Sign up for Fantasy Football
http://football.fantasysports.yahoo.com
I was under the impression that doing this at FS level is a futile
exercise?
As the poster below me pointed out a delete in explorer is a rename/move
operation.
Only the shift-delete is a “proper” delete. (unless of course recycle
bin is disabled.)
Of course this depends what your goals are…
I’m pretty sure this has been discussed on the list before… I suggest
you check the archives.
BR,
Rob Linegar
Software Engineer
Data Encryption Systems Limited
www.des.co.uk | www.deslock.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ladislav Zezula
Sent: 28 June 2005 11:58
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] differentiating between DELETE and SHIFT+DELETE
If you really want to investigate the requests sent after
Delete or Shift+Delete, I recommend you to write
a small testprogram with DeleteFile() call and with
SHFileOperation (The API causing move file to recycle
Bin). The requests can be easier filtered by Filemon,
and you can learn from it. Then move “to the real world”
and watch Explorer activity. Starting with Explorer
without deep knowledge may be confusing.
L.
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@des.co.uk
To unsubscribe send a blank email to xxxxx@lists.osr.com