I am testing a file system. It works fine with all Info class of IRP_MJ_SET_Information. But When it attempt to delete a file using FileDisposition Information It is getting access denied from outside of the file system.I am not getting any IRP in the file system. And I am not able to delete file from my File System.I got this status (ACCESS_DENIED )from FileSpy program.
What is the reason of this behavior ?
How to solve this kind of problem when there is no trace where from this action is getting performed ?
Ok. I Tested again this time with FILE_DELETE Access.But again this time also i am not getting request in my file system again and result is getting STATUS_SUCCESS.Neither File Spy showing Any IRP_SET_INFOTMATION .but file was never deleted from file system. How this is possible?
One more query is that My file system is working fine with normal files.But some executable that are not multiple of the the size of File Allocation UNIT are not getting executed and Access Denied MSg is thrown by CMD and this is happening with executable only.I matched the binary actual data is same in the executable and executable(Copy) in my file system.Why are executable behaving differently?
No, I mean Status was success . But it was not completed from my file system.Interesting point is that file system never received a request to delete the file (But received other request like query information and file listing).Then how is request is completing.
It should have received IRP_MJ_SET_INFORMATION with FileDispositionInformation class.And similarly if request was not recived by FS then file would never get deleted actually.That’s why even after deletion Success (not from my file system i dont’ know how it is getting success), file is visible in next listing.
In Windows 8, files are now routinely deleted using FILE_DELETE_ON_CLOSE and not by IRP_MJ_SET_INFORMATION, which is why I asked the question.
If you think the IRP_MJ_SET_INFORMATION was completed above you, I suppose that’s possible, but it doesn’t seem as if it would work for any file on any file system.
Good luck tracking it down - it will be interesting to learn what you determine is causing this behavior.