Mini-filter: How to open a file with DeletePending?

NTDEV
1

I am writing a mini-filter which needs to open files before they are
deleted. I am filtering on _MJ_CLOSE and then checking the
DeletePending flag on the associated FILE_OBJECT. I need to open the
file for write access to wipe the contents, but no matter what I have
tried I always get a status STATUS_DELETE_PENDING from the Open
function. I have tried FltCreateFile, ZwCreateFile & IoCreateFile.

There must be some way to do this!

Can anyone shed some light on how this might be accomplished?

Thanks very much!
John

2

xxxxx@charter.net wrote:

I am writing a mini-filter which needs to open files before they are
deleted. I am filtering on _MJ_CLOSE and then checking the
DeletePending flag on the associated FILE_OBJECT. I need to open the
file for write access to wipe the contents, but no matter what I have
tried I always get a status STATUS_DELETE_PENDING from the Open
function. I have tried FltCreateFile, ZwCreateFile & IoCreateFile.

There must be some way to do this!

Can anyone shed some light on how this might be accomplished?

Thanks very much!
John

You probably want to post this ntfsd.

mm