explorer and cmd window behave differently in case of delete

Hi

I am having a filter driver over NTFS…(windows NT 4.0)
When I try to delete a file from cmd. window , it goes through properly.
But if I try to do it through explorer, the lower driver gives an error (
it says the file may be write protected etc…But file is having FULL
CONTROL ALL perms.) Actually error 0xc0000022, access denied is returned
when my filter passes the rename request down ( delete irp passed down
without problem)… The same file can be renamed from cmd. window or
explorer without any problem…

Can anybody help me…? Is it a problem of some other instance of the file
object still being open ? if it is so, is there any way to forcefully
close all other instances of a particular file object…?

thanks,
vishnu.

Hi all,

One more addl. info to my earlier mail…I am able to move any file from
cmd. window to any other folder on the drive , but not able to
move(through move cmd.) files to the RECYCLER\S-1-…\ folder. File
perms. of the RECYCLER folder is
Full Control All…

Can anybody help me ?

thanks
vishnu.


Hi

I am having a filter driver over NTFS…(windows NT 4.0)
When I try to delete a file from cmd. window , it goes through properly.
But if I try to do it through explorer, the lower driver gives an error (
it says the file may be write protected etc…But file is having FULL
CONTROL ALL perms.) Actually error 0xc0000022, access denied is returned
when my filter passes the rename request down ( delete irp passed down
without problem)… The same file can be renamed from cmd. window or
explorer without any problem…

Can anybody help me…? Is it a problem of some other instance of the file
object still being open ? if it is so, is there any way to forcefully
close all other instances of a particular file object…?

thanks,
vishnu.

I have seen this behavior as well. I am no recycling bin expert, but it
appears that there is a file hidden file in the root directory of each
file system that has a list of filenames that should be present in the
recycler directory.

Based on the filenames present in this file, the Explorer will generate a
filename for tne next file to go into the recycler. If that filename
already exists in the recycler directory, the operation fails.

I have seen cases when the files actually present in the recycler
directory get out of sync with the hidden file in the root directory.

Maybe this will help.

Don

thanks don,

I have a related qtn. this time…
if i delete the file from explorer i get the following IRPs.(output from
filemon).(this result is without my filter driver.ie, just ntfs)

1 8:56:21
AM explorer.exe:164 IRP_MJ_CREATE E:\testv.out SUCCESS Attributes: Any
Options: Open
2 8:56:21
AM explorer.exe:164 FASTIO_QUERY_BASIC_INFO E:\testv.out SUCCESS Attributes:
A
3 8:56:21 AM explorer.exe:164 IRP_MJ_CLEANUP E:\testv.out SUCCESS
4 8:56:21 AM explorer.exe:164 IRP_MJ_CLOSE E:\testv.out SUCCESS
5 8:56:21
AM explorer.exe:164 IRP_MJ_CREATE E:\testv.out SUCCESS Attributes: Any
Options: Open
6 8:56:21 AM explorer.exe:164 IRP_MJ_SET_INFORMATION
E:\testv.out SUCCESS FileDispositionInformation
7 8:56:21 AM explorer.exe:164 IRP_MJ_SET_INFORMATION
E:\testv.out SUCCESS FileDispositionInformation
8 8:56:21 AM explorer.exe:164 IRP_MJ_CLEANUP E:\testv.out SUCCESS
9 8:56:21 AM explorer.exe:164 IRP_MJ_CLOSE E:\testv.out SUCCESS
10 8:56:21
AM explorer.exe:164 IRP_MJ_CREATE E:\testv.out SUCCESS Attributes: Any
Options: Open WriteThrough
11 8:56:21
AM explorer.exe:164 IRP_MJ_CREATE E:\RECYCLER\S-1-5-21-1097929292-733637098-618671499-500\DE5.OUT SUCCESS Attributes:
Any Options: Open
12 8:56:21
AM explorer.exe:164 IRP_MJ_CREATE E:\RECYCLER\S-1-5-21-1097929292-733637098-618671499-500\DE5.OUT FILE
NOT FOUND Attributes: N Options: Open
13 8:56:21 AM explorer.exe:164 IRP_MJ_SET_INFORMATION
E:\testv.out SUCCESS FileRenameInformation
14 8:56:21
AM explorer.exe:164 IRP_MJ_CREATE E:\testv.out SUCCESS Attributes: Any
Options: Open
15 8:56:21
AM explorer.exe:164 IRP_MJ_QUERY_INFORMATION E:\testv.out SUCCESS FileBasicInformation

16 8:56:21 AM explorer.exe:164 IRP_MJ_CLEANUP E:\testv.out SUCCESS
17 8:56:21 AM explorer.exe:164 IRP_MJ_CLOSE E:\testv.out SUCCESS
18 8:56:21 AM explorer.exe:164 IRP_MJ_DIRECTORY_CONTROL E:\ Change Notify


Can somebody answer to the following qts.?

  1. WHy in step 10, IRP_MJ_CREATE is coming for file testv.out after the
    file had IRP_MJ_SET_INFORMATION , IRP_MJ_CLEANUP & IRP_MJ_CLOSE ? After
    that IRP_MJ_CLOSE , file should be deleted , right ?

  2. When it finally comes to IRP_MJ_SET_INFORMATION ( renameinfo) , is
    there
    anyway to know this file was earlier marked for deletion(ie, gone through
    IRP_MJ_SET_INFORMATION-dispositioninfo) ?
    (even if try setting some flag information on file object when
    setinformation
    irp with dispositioninfo comes, that flag will be unset because of the
    close
    oprns. in betn’ delete & rename irps, right? )

thanks in advance,
vishnu.

I have seen this behavior as well. I am no recycling bin expert, but it
appears that there is a file hidden file in the root directory of each
file system that has a list of filenames that should be present in the
recycler directory.

Based on the filenames present in this file, the Explorer will generate a
filename for tne next file to go into the recycler. If that filename
already exists in the recycler directory, the operation fails.

I have seen cases when the files actually present in the recycler
directory get out of sync with the hidden file in the root directory.

Maybe this will help.

Don