Fail Delete in IRP_MJ_CLOSE

NTDEV
1

Can I prevent deletion of files in IRP_MJ_CLOSE. (Permanent Delete not
recycle bin )
I can catch them in IRP_MJ_CLOSE as

irpStack = IoGetCurrentIrpStackLocation( Irp );
fileObject = irpStack->FileObject;

if ( *( &fileObject->DeletePending) == 0x01)
{
DbgPrint("\nSpyClose:Delete IRP:%x",Irp);
*( &fileObject->DeletePending) = 0x00; // this does not stop the
deletion
}

I am aware of the way with SET_INFORMATION -> FileDispositionInformation
but want to do it in IRP_MJ_CLOSE.
Any ideas?

Anurag

2

I think not, but you might want to ask on ntfsd instead.

=====================
Mark Roddy

-----Original Message-----
From: Anurag Sarin [mailto:xxxxx@divassoftware.com]
Sent: Tuesday, October 26, 2004 12:50 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Fail Delete in IRP_MJ_CLOSE

Can I prevent deletion of files in IRP_MJ_CLOSE. (Permanent Delete not
recycle bin ) I can catch them in IRP_MJ_CLOSE as

irpStack = IoGetCurrentIrpStackLocation( Irp );
fileObject = irpStack->FileObject;

if ( *( &fileObject->DeletePending) == 0x01)
{
DbgPrint("\nSpyClose:Delete IRP:%x",Irp);
*( &fileObject->DeletePending) = 0x00; // this does not stop the deletion
}

I am aware of the way with SET_INFORMATION -> FileDispositionInformation but
want to do it in IRP_MJ_CLOSE.
Any ideas?

Anurag

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ''
To unsubscribe send a blank email to xxxxx@lists.osr.com