Hi,
Can anybody tell me what IRPs are triggered for the threee actions:delete,
rename and format respectively?
Thank you for you guidance.
Bill
download filemon from sysinternals.com and fire it up, then see what
happens when you do those operations. it’s prolly
irp_mj_set_information for delete and rename. dunno about format.
> Can anybody tell me what IRPs are triggered for the threee actions:delete,
IRP_MJ_SET_INFORMATION/FileDispositionInformation and also ZwCreateFile with
FILE_DELETE_ON_CLOSE.
rename
IRP_MJ_SET_INFORMATION/FileRenameInformation
format respectively?
Format is not a single IRP. It means dismounting the current volume, and then
writing the new empty filesystem image to the device blockwise.
You can fail FSCTL_LOCK_VOLUME or FSCTL_DISMOUNT_VOLUME to prevent formatting.
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com