We check the ccb (ccb->cc_flags & CCB_DELONCLOSE) on the close to see if
the delete on close flag is set.
Also, we set this flag in a separate structure we keep off of the ccb if
we are called to FileDispositionInformation to change to delete.
The delete is really coming in on the “close” and not the create.
So, you could move your work/code to close instead of create and check
these two structures (ccb and your own) to see if the file is going
away.
Jim
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shangwu
Sent: Friday, February 03, 2006 8:21 AM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] Re:Re:Detect FILE_DELETE_ON_CLOSE Problem
No way you can detect that a file will be deleted under IRP_MJ_CREATE in
all
cases.
The following method tells the possibility of deletion or rename.
if (IrpSp->Parameters.Create.SecurityContext->DesiredAccess & DELETE)
{ // rename or delete }
“Bin Zeng” wrote in message news:xxxxx@ntfsd…
> Hi,Shangwu
>
> Thanks for your reply. You are right, but the point is how i know this
> file will be
> deleted without the flag “FILE_DELETE_ON_CLOSE” in IRP_MJ_CREATE ?
>
> And what’s different for “rename” and “delete” a file in
IRP_MJ_CREATE ?
>
> I need to detect the file delete in IRP_MJ_CREATE, not in
> IRP_MJ_SETINFORMATION .
>
> Is it possible to do that?
>
> Thanks
>
> Bin
>
>
>>From: “Shangwu”
>>Reply-To: “Windows File Systems Devs Interest List”
>>To: “Windows File Systems Devs Interest List”
>>Subject: Re:[ntfsd] Re:Detect FILE_DELETE_ON_CLOSE Problem
>>Date: Thu, 2 Feb 2006 18:03:23 -0500
>>
>>You need save the file object pointer in which you are interested
under
>>IRP_MJ_CREATE. Then filter IRP_MJ_SETINFORMATION to check if the file
is
>>to
>>be deleted.
>>
>>“Bin Zeng” wrote in message news:xxxxx@ntfsd…
>> > Thanks for your reply.
>> >
>> > Because i need to change the filename when someone try to delete a
>> > file.
>> > how can i detect the “Delete” request in IRP_MJ_CREATE when
someone
>> > try to delete the file with windows explorer?
>> >
>> > Regards
>> >
>> > Bin
>> >
>> >
>> >>From: “Shangwu”
>> >>Reply-To: “Windows File Systems Devs Interest List”
>>
>> >>To: “Windows File Systems Devs Interest List”
>> >>Subject: Re:[ntfsd] Detect FILE_DELETE_ON_CLOSE Problem
>> >>Date: Thu, 2 Feb 2006 17:20:49 -0500
>> >>
>> >>It is not always to delete a file by specifying that flag when the
file
>>is
>> >>opened.
>> >>ZwSetInformationFile or its IRP can be used to delete files.
>> >>
>> >>“Bin Zeng” wrote in message news:xxxxx@ntfsd…
>> >> > Hi,Experts
>> >> >
>> >> > I try to detect the flag FILE_DELETE_ON_CLOSE in IRP_MJ_CREATE
,
>> >> >
>> >> > My code like the following:
>> >> >
>> >> > if( IrpSp->Parameters.Create.Options & FILE_DELETE_ON_CLOSE )
>> >> > {
>> >> > KdPrint((" delete the file on close flag = %wZ
>> >> > \n",&FileObject->FileName));
>> >> > }
>> >> >
>> >> > I delete the files, but I never get the print , even i try this
in
>>the
>> >> > completion routine.
>> >> >
>> >> > Anyone can help ?
>> >> >
>> >> > Thanks
>> >> >
>> >> > Bin
>> >> >
>> >> >
>> >> >
>> >> >
>> >>
>> >>
>> >>
>> >>—
>> >>Questions? First check the IFS FAQ at
>> >>https://www.osronline.com/article.cfm?id=17
>> >>
>> >>You are currently subscribed to ntfsd as: xxxxx@hotmail.com
>> >>To unsubscribe send a blank email to
xxxxx@lists.osr.com
>> >
>> >
>> >
>> >
>>
>>
>>
>>—
>>Questions? First check the IFS FAQ at
>>https://www.osronline.com/article.cfm?id=17
>>
>>You are currently subscribed to ntfsd as: xxxxx@hotmail.com
>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
>
—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@adic.com
To unsubscribe send a blank email to xxxxx@lists.osr.com