Filtering a delete file...

NTFSD
1

Hi, to handle a delete file I should filter a IRP_MJ_SET_INFORMATION and
look for a rename operation, where the destination is the recycle bin,
am I right?

Lorenzo

2

Also creates with the FILE_DELETE_ON_CLOSE flag and destructive renames
(file A is renamed over file B with the ReplaceIfExists flag set).

Lorenzo wrote:

Hi, to handle a delete file I should filter a IRP_MJ_SET_INFORMATION and
look for a rename operation, where the destination is the recycle bin,
am I right?

Lorenzo

–
Nick Ryan (MVP for DDK)

3

This approach may fail if file deletion to recycle bin is disabled .i.e., if
the files get deleted instead of being renamed into recycle bin.

The best I have seen is combination of what you are doing and filtering
IRP_MJ_CLOSE. Check for FileDelete flag…

Vikas

Hi, to handle a delete file I should filter a IRP_MJ_SET_INFORMATION and
look for a rename operation, where the destination is the recycle bin,
am I right?

Lorenzo

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@agglut.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

it depends on what do you mean by delete. if it is a delete in windows
explorer, it should be a IRP_MJ_SET_INFORMATION rename operation to the
recycle bin. if it is a delete as interpreted in the file system, it will be
a IRP_MJ_SET_INFORMATION disposition operation.

Ampsi

----- Original Message -----
From: “Lorenzo”
Newsgroups: ntfsd
To: “Windows File Systems Devs Interest List”
Sent: Wednesday, November 19, 2003 02:14
Subject: [ntfsd] Filtering a delete file…

Hi, to handle a delete file I should filter a IRP_MJ_SET_INFORMATION and
look for a rename operation, where the destination is the recycle bin,
am I right?

Lorenzo

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@hotmail.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

Well, basicly I need to know when a file gets deleted from a folder that
I’m monitoring, what about a combination of IRP_MJ_SET_INFORMATION and
checking the DeletePending flag (as already stated) (I should check it
on IRP_MJ_CLOSE, right?)?

Another question, not related to delete file, but I need to perform some
operation only if the operation requested is processed successfully by
the file system that I’m filtering, so I set a CompletionRoutine, now I
don’t care about fail or cancel, but I care only about Successful
operation, so I should only set to true InvokeOnSuccess, right?

Thanks.

Lorenzo

6

The folder itself could also disappear - at least by its current name.
From an explorer view, a folder would disappear if an application
renames the folder or a parent of the folder. Not sure if you care
about this.
/TomH

-----Original Message-----
From: Lorenzo [mailto:xxxxx@email.it]
Sent: Wednesday, November 19, 2003 7:54 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Re: Filtering a delete file…

Well, basicly I need to know when a file gets deleted from a folder that

I’m monitoring, what about a combination of IRP_MJ_SET_INFORMATION and
checking the DeletePending flag (as already stated) (I should check it
on IRP_MJ_CLOSE, right?)?

Another question, not related to delete file, but I need to perform some

operation only if the operation requested is processed successfully by
the file system that I’m filtering, so I set a CompletionRoutine, now I
don’t care about fail or cancel, but I care only about Successful
operation, so I should only set to true InvokeOnSuccess, right?

Thanks.

Lorenzo

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@exagrid.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

7

It depends, if you are passing a completion context to the completion
routine that needs to be freed you need to be invoked on all 3 cases so
you won’t leak memory.

If a completion routine is needed I recommend that you set all 3 values
to TRUE, thus you will always get the completion callbacks and you deal
with the appropriate status. It makes the code easier to maintain in
the long run. A change in the future won’t introduce a memory leak or a
hang in error or canceled operations. Also, there is no performance
gain by limiting these calls unless you have written a very inefficient
completion routine (which you should fix anyway).

Neal Christiansen
Microsoft File System Filter Group

This posting is provided “AS IS” with no warranties, and confers no
rights.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Lorenzo
Sent: Wednesday, November 19, 2003 4:54 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Re: Filtering a delete file…

Well, basicly I need to know when a file gets deleted from a folder that

I’m monitoring, what about a combination of IRP_MJ_SET_INFORMATION and
checking the DeletePending flag (as already stated) (I should check it
on IRP_MJ_CLOSE, right?)?

Another question, not related to delete file, but I need to perform some

operation only if the operation requested is processed successfully by
the file system that I’m filtering, so I set a CompletionRoutine, now I
don’t care about fail or cancel, but I care only about Successful
operation, so I should only set to true InvokeOnSuccess, right?

Thanks.

Lorenzo

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com