How to recognize which IRP_MJ_CLOSE really means file closed.

NTFSD
1

I’m wondering how to recognize which IRP_MJ_CLOSE really mean it’s the time
to close file.
Cause every option could make IRP_MJ_CLOSE while it’s finished.

Could anybody, please guide me to understand this better?

Thanks in Advance,
Mongo

2

What you mean about CLOSE file? Just close an instance of the file or close
all the instances of the file? You may need to check IRP_MJ_CLEANUP

On Tue, Aug 19, 2008 at 1:31 AM, Mongo Chen wrote:

> I’m wondering how to recognize which IRP_MJ_CLOSE really mean it’s the time
> to close file.
> Cause every option could make IRP_MJ_CLOSE while it’s finished.
>
> Could anybody, please guide me to understand this better?
>
> Thanks in Advance,
> Mongo
> — NTFSD is sponsored by OSR For our schedule debugging and file system
> seminars (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars You are currently subscribed to ntfsd as:
> xxxxx@gmail.com To unsubscribe send a blank email to
> xxxxx@lists.osr.com