Ok, sorry, overlooked the “over existing file” part.
Tried again the same scenario. Explorer first tries to do a rename:
IRP_MJ_SET_INFORMATION
E:\huhu.exe
STATUS_OBJECT_NAME_COLLISION
FileRenameInformation FileObject: 84373AC0 ReplaceIfExists: 0
But apparently they set ReplaceIfExists to FALSE to be able to catch
the sace when the target file exists. So it returns error code.
Then explorer asks you if you want to replace file or not,
and if you say “replace”, it then copies the file
(I’ve seen pair of IRP_MJ_READ from source file and
IRP_MJ_WRITE) to target file.
I guess this could have been done more effectively, but,
you know, it’s Explorer, it always does things in unusual way 
L.
> I tried this:
- Created the file E:\Huhu.txt
1a. Create E:\Work\huhu.txt, as well.
- Opened 2 windows in Explorer, "E:" and “E:\Work”
- Selected “huhu.txt” in the first window by the mouse
- Pressed Ctrl+X
- Clicked to window with “E:\Work”
- Pressed Ctrl+V
FileSpy showed me (amongst about zillion other I/Os)
IRM_MJ_SET_INFORMATION (FileRenameInformation).
Maybe it’s something specific in your OS config ?
–
Kind regards, Dejan
http://www.alfasp.com
File system audit, security and encryption kits.
It used to try a Rename and fall back to a Move only if Rename could
not happen in XP.
I guess this could have been done more effectively, but, you know, it’s
Explorer, it always does things in unusual way
–
Kind regards, Dejan
http://www.alfasp.com
File system audit, security and encryption kits.