Minifilter and file deletion!

NTFSD
1

Hi!
I am implementing a minifilter in which i want to take a backup of the file that is being deleted( by setting flags in IRP_MJ_CREATE or IRP_MJ_SET_INFORMATION).
This is to ensure that i can restore the file at a later stage.
The simplest way is to copy the entire file.
But this does not seem to be an effective technique. This can cause the system to slow down tremendously. Suppose the user requests the deletion of a 512 MB or a 1 GB file…
Copying the contents of the file to some backup file/volume is not a good approach.
Please suggest some efficient backup techniques for handling the deletion of files.
Thanks!
Ayush.

2

when the file is going to be deleted:

  • let your FileContext contains DeletePending flag, it’ll be set to true
    if IRP_MJ_CREATE is called with FILE_DELETE_ON_CLOSE flag (note, you have to
    check if the file is not hardlink, then you may ignore the file, because it
    may not be from your backup folder).
  • set the flag to false if IRP_MJ_SET_INFORMATION is called with
    FileDispositionInformation/DeleteFile = false
  • in irp_mj_close check if the flag is still true, then move the file
    and reset the flag! (if you fail, you should copy the file)

Petr Kurtin

wrote in message news:xxxxx@ntfsd…
> Hi!
> I am implementing a minifilter in which i want to take a backup of the
> file that is being deleted( by setting flags in IRP_MJ_CREATE or
> IRP_MJ_SET_INFORMATION).
> This is to ensure that i can restore the file at a later stage.
> The simplest way is to copy the entire file.
> But this does not seem to be an effective technique. This can cause the
> system to slow down tremendously. Suppose the user requests the deletion
> of a 512 MB or a 1 GB file…
> Copying the contents of the file to some backup file/volume is not a good
> approach.
> Please suggest some efficient backup techniques for handling the deletion
> of files.
> Thanks!
> Ayush.
>

3

> Please suggest some efficient backup techniques for handling the deletion of

files.

Recycle Bin is one :slight_smile:

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

4

Rename the file, don’t delete it.

t.

5

I’ll wager you cant solve this without breaking something :slight_smile:

wrote in message news:xxxxx@ntfsd…
> Hi!
> I am implementing a minifilter in which i want to take a backup of the
> file that is being deleted( by setting flags in IRP_MJ_CREATE or
> IRP_MJ_SET_INFORMATION).
> This is to ensure that i can restore the file at a later stage.
> The simplest way is to copy the entire file.
> But this does not seem to be an effective technique. This can cause the
> system to slow down tremendously. Suppose the user requests the deletion
> of a 512 MB or a 1 GB file…
> Copying the contents of the file to some backup file/volume is not a good
> approach.
> Please suggest some efficient backup techniques for handling the deletion
> of files.
> Thanks!
> Ayush.
>