FileDispositionInformation (Deletes) before FileRenameInformation (renames)

NTFSD
1

Sorry that the title is sort of cryptic, but the news server rejected my
non-cryptic title which was much clearer.

Hi all, I’ve built a little minifilter to watch what is happening when you
delete a file with the explorer.

Basically, I’m picking up, in a preoperation callout, the
IRP_MJ_SET_INFORMATION looking for FileRenameInformation for Renames and
FileDispositionInformation (delete flag) for Deletes and IRP_MJ_CREATE with
the File_DELETEP_ON_CLOSE options flag set.

When I delete the file, I get a Delete coming thru on the file I deleted and
then a get a Rename on it to the recycler. Which makes some sense, but it
seems to be backwards.I would have expected a “Rename” and no delete (a
move) or since this is low level, a rename then a delete (a copy and then a
delete) but a delete then a rename?

I thought that maybe the Delete is a “high level” routine that copies the
file to the recycler, but the same results seems to be happening when catch
them in a postoperation callout.

Does anyone know what I’m missing?

Thanks,

Gene

2

If I understand your question correctly, this is what I think is happening.

Delete from Explorer is actually a rename to the Recycle Bin. The initial
open with Delete is done to make sure the user has permission to delete the
file. The Rename then actually moves it to the Recycle Bin.

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Gene Allen
Sent: Thursday, August 11, 2005 12:22 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] FileDispositionInformation (Deletes) before
FileRenameInformation (renames)

Sorry that the title is sort of cryptic, but the news server rejected my
non-cryptic title which was much clearer.

Hi all, I’ve built a little minifilter to watch what is happening when you
delete a file with the explorer.

Basically, I’m picking up, in a preoperation callout, the
IRP_MJ_SET_INFORMATION looking for FileRenameInformation for Renames and
FileDispositionInformation (delete flag) for Deletes and IRP_MJ_CREATE with
the File_DELETEP_ON_CLOSE options flag set.

When I delete the file, I get a Delete coming thru on the file I deleted and

then a get a Rename on it to the recycler. Which makes some sense, but it
seems to be backwards.I would have expected a “Rename” and no delete (a
move) or since this is low level, a rename then a delete (a copy and then a
delete) but a delete then a rename?

I thought that maybe the Delete is a “high level” routine that copies the
file to the recycler, but the same results seems to be happening when catch
them in a postoperation callout.

Does anyone know what I’m missing?

Thanks,

Gene

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Explorer “deletes” the file then cancels the “delete”.
It does this to make sure the delete operation would
succeed before renaming it to the recycle bin.

When a file is deleted via a set_information irp, the
delete does not happen until the file is closed.
Anytime before the file is closed, another
set_information can easily be sent that cancels the
original delete request.

— Gene Allen wrote:

> Sorry that the title is sort of cryptic, but the
> news server rejected my
> non-cryptic title which was much clearer.
>
> Hi all, I’ve built a little minifilter to watch what
> is happening when you
> delete a file with the explorer.
>
> Basically, I’m picking up, in a preoperation
> callout, the
> IRP_MJ_SET_INFORMATION looking for
> FileRenameInformation for Renames and
> FileDispositionInformation (delete flag) for Deletes
> and IRP_MJ_CREATE with
> the File_DELETEP_ON_CLOSE options flag set.
>
> When I delete the file, I get a Delete coming thru
> on the file I deleted and
> then a get a Rename on it to the recycler. Which
> makes some sense, but it
> seems to be backwards.I would have expected a
> “Rename” and no delete (a
> move) or since this is low level, a rename then a
> delete (a copy and then a
> delete) but a delete then a rename?
>
> I thought that maybe the Delete is a “high level”
> routine that copies the
> file to the recycler, but the same results seems to
> be happening when catch
> them in a postoperation callout.
>
> Does anyone know what I’m missing?
>
> Thanks,
>
> Gene
>
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>