There’s a very good article on rename operations at
http://www.osr.com/insider/1997/rename.htm.
However, the article does not discuss the flag that David mentioned. I
believe that flag is SL_OPEN_TARGET_DIRECTORY. This flag is a result of
some weird interactions between ZwSetInformationFile and the file system
driver. The “IO Manager” tries to facilitate the FSD’s progress by opening
the target directory during a rename. This is the origin of the
SL_OPEN_TARGET_DIRECTORY flag.
If the filename does not have a corresponding directory entry, the FSD opens
the parent directory of the filename that will exist after the rename.
There is code in FASTFAT that illustrates this. If you don’t have the IFS
kit, you should acquire it.
-----Original Message-----
From: COX,DAVID (HP-Roseville,ex1) [mailto:david_cox2@hp.com]
Sent: Sunday, April 16, 2000 10:49 PM
To: File Systems Developers
Subject: [ntfsd] RE: Recognize when IRP_MJ_SET_INFORMATION (RenameInfo
rmat ion) deletes a directoryIf I remember correctly, a second FILE_OBJECT will be CREATEd, with a
flag set indicating it is a rename target. It will succeed without
actually creating a new file in the target location. The target path
can probably be used to determine if it is in the recycler.
Dave Cox
Hewlett-Packard Co.
HPSO/SSMO (Santa Barbara)
https://ecardfile.com/id/Dave+Cox-----Original Message-----
From: Jack Brown [mailto:xxxxx@hotmail.com]
Sent: Saturday, April 15, 2000 4:14 AM
To: File Systems Developers
Subject: [ntfsd] RE: Recognize when IRP_MJ_SET_INFORMATION (RenameInfo
rmat ion) deletes a directoryThanks Rob,
That was exacly what I meant but I see that I should define
my problem in
more details - How can I recognize that
IRP_MJ_SET_INFORMATION of class
FileRenameInformation moves a directory to the Recycle Bin
but not just
renames it really? Actualy I assume in my driver that if a
directory or a
file is in the Recycle Bin then it is deleted.
Thank you all of you and especially Rob!
Jack>From: Rob Fuller
> >Reply-To: “File Systems Developers”
> >To: “File Systems Developers”
> >Subject: [ntfsd] RE: Recognize when IRP_MJ_SET_INFORMATION
> >(RenameInfo rmat ion) deletes a directory
> >Date: Fri, 14 Apr 2000 17:56:16 -0500
> >
> >In general, when you “delete” a file or directory through
> Explorer, the
> >file
> >is renamed into the Recycle Bin directory. This corresponds to an
> >IRP_MJ_SET_INFORMATION of class FileRenameInformation. When
> you empty the
> >recycle bin, the file is really deleted, which corresponds to an
> >IRP_MJ_SET_INFORMATION of class FileDispositionInformation.
> >
> >If you have configured your recycle bin not to collect
> “deleted” files,
> >then
> >the file is really deleted, instead of renamed into the
> recycle bin. This
> >corresponds to an IRP_MJ_SET_INFORMATION of class
> >FileDispositionInformation.
> >
> >When you delete a file or directory from the command line,
> it is never
> >placed in the recycle bin. Instead it is deleted with an
> >IRP_MJ_SET_INFORMATION of class FileDispositionInformation.
> >
> >Does this help?
> >
> > > -----Original Message-----
> > > From: COX,DAVID (HP-Roseville,ex1) [mailto:david_cox2@hp.com]
> > > Sent: Friday, April 14, 2000 4:53 PM
> > > To: File Systems Developers
> > > Subject: [ntfsd] RE: Recognize when
> IRP_MJ_SET_INFORMATION (RenameInfo
> > > rmat ion) deletes a directory
> > >
> > >
> > > How would that make any sense?
> > > I just tried this, and watched with sysinternals’ FileMon.
> > > Given the empty
> > > directory:
> > >
> > > “d:\test\delete_me”
> > >
> > > I ran the command
> > >
> > > d:\test> rmdir delete_me
> > >
> > > And here’s the FileMon trace:
> > >
> > > 4 2:29:28 PM cmd.exe IRP_MJ_CREATE
> D:\test\delete_me
> > > SUCCESS Attributes:0000 Options:01000021
> > > 5 2:29:28 PM cmd.exe IRP_MJ_SET_INFORMATION
> D:\test\delete_me
> > > SUCCESS FileDispositionInformation
> > > 6 2:29:28 PM cmd.exe IRP_MJ_CLEANUP
> D:\test\delete_me
> > > SUCCESS
> > > 7 2:29:28 PM cmd.exe IRP_MJ_CLOSE
> D:\test\delete_me
> > > SUCCESS
> > >
> > > --------------------------------------------------------------
> > > ---------
> > > Dave Cox
> > > Hewlett-Packard Co.
> > > HPSO/SSMO (Santa Barbara)
> > > https://ecardfile.com/id/Dave+Cox
> > >
> > >
> > > -----Original Message-----
> > > From: Jack Brown [mailto:xxxxx@hotmail.com]
> > > Sent: Friday, April 14, 2000 1:57 AM
> > > To: File Systems Developers
> > > Subject: [ntfsd] RE: Recognize when IRP_MJ_SET_INFORMATION
> > > (RenameInformat ion) deletes a directory
> > >
> > >
> > > FileDispositionInformation is used only for files.
> > > If you delete an empty directory it is done by
> FileRenameInformation.
> > >
> > > >From: “COX,DAVID (HP-Roseville,ex1)” <david_cox2>
> > > >Reply-To: “File Systems Developers”
> > > >To: “File Systems Developers”
> > > >Subject: [ntfsd] RE: Recognize when IRP_MJ_SET_INFORMATION
> > > >(RenameInformat ion) deletes a directory
> > > >Date: Thu, 13 Apr 2000 10:17:25 -0700
> > > >
> > > >Why would it use FileRenameInformation to effect a
> directory delete?
> > > >
> > > >How about FileDispositionInformation, with the struct
> > > >
> > > > FILE_DISPOSITION_INFORMATION
> > > > {
> > > > BOOLEAN DeleteFile;
> > > > }
> > > >
> > > >-------------------------------------------------------------
> > > ----------
> > > >Dave Cox
> > > >Hewlett-Packard Co.
> > > >HPSO/SSMO (Santa Barbara)
> > > >https://ecardfile.com/id/Dave+Cox
> > > >
> > > >
> > > >-----Original Message-----
> > > >From: Jack Brown [mailto:xxxxx@hotmail.com]
> > > >Sent: Thursday, April 13, 2000 5:00 AM
> > > >To: File Systems Developers
> > > >Subject: [ntfsd] Recognize when IRP_MJ_SET_INFORMATION
> > > >(RenameInformation) deletes a directory
> > > >
> > > >
> > > >I want to recognize the moment when FSD deletes a directory.
> > > I found that
> > > >it
> > > >
> > > >is done by IRP_MJ_SET_INFORMATION (FileRenameInformation). I
> > > have a file
> > > >system filter and in its completeion routine I am trying
> to find when
> > > >exactly a directory has been deleted.
> > > >One of the parameters that I have to examine is
> > > ReplaceIfExists. I think it
> > > >should be set to TRUE. But is it enough to assume that the
> > > directory is
> > > >deleted?
> > > >
> > > >Thanks
> > > >Jack
> > > >
> > > >Get Your Private, Free Email at http://www.hotmail.com
> > > >
> > > >
> > > >—
> > > >You are currently subscribed to ntfsd as: david_cox2@hp.com
> > > >To unsubscribe send a blank email to
> $subst(‘Email.Unsub’)
> > > >
> > > >—
> > > >You are currently subscribed to ntfsd as:
> xxxxx@hotmail.com
> > > >To unsubscribe send a blank email to
> $subst(‘Email.Unsub’)
> > > >
> > >
> > >_
> > > Get Your Private, Free Email at http://www.hotmail.com
> > >
> > >
> > > —
> > > You are currently subscribed to ntfsd as: david_cox2@hp.com
> > > To unsubscribe send a blank email to
> $subst(‘Email.Unsub’)
> > >
> > > —
> > > You are currently subscribed to ntfsd as: xxxxx@nsisw.com
> > > To unsubscribe send a blank email to
> $subst(‘Email.Unsub’)
> > >
> >
> >—
> >You are currently subscribed to ntfsd as: xxxxx@hotmail.com
> >To unsubscribe send a blank email to $subst(‘Email.Unsub’)
> >
>
> ______________________________________________________
> Get Your Private, Free Email at http://www.hotmail.com
>
>
> —
> You are currently subscribed to ntfsd as: david_cox2@hp.com
> To unsubscribe send a blank email to $subst(‘Email.Unsub’)
>
> —
> You are currently subscribed to ntfsd as: xxxxx@nsisw.com
> To unsubscribe send a blank email to $subst(‘Email.Unsub’)
></david_cox2>