The only approach I know of to this question is to ensure that (a) you will
see all IRP_MJ_CREATE and (b) you will see all IRP_MJ_SET_INFORMATION
FileDispositionInformation and then to track the variable semantics of
delete implemented in the underlying file system.
It seems to me there ought to be a quite reasonable enhancement request with
respect to the filter manager framework here.
“Bin Zeng” wrote in message news:xxxxx@ntfsd…
> Hi,Shangwu
>
> Thanks for your reply. You are right, but the point is how i know this
> file will be
> deleted without the flag “FILE_DELETE_ON_CLOSE” in IRP_MJ_CREATE ?
>
> And what’s different for “rename” and “delete” a file in IRP_MJ_CREATE ?
>
> I need to detect the file delete in IRP_MJ_CREATE, not in
> IRP_MJ_SETINFORMATION .
>
> Is it possible to do that?
>
> Thanks
>
> Bin
>
>
>>From: “Shangwu”
>>Reply-To: “Windows File Systems Devs Interest List”
>>To: “Windows File Systems Devs Interest List”
>>Subject: Re:[ntfsd] Re:Detect FILE_DELETE_ON_CLOSE Problem
>>Date: Thu, 2 Feb 2006 18:03:23 -0500
>>
>>You need save the file object pointer in which you are interested under
>>IRP_MJ_CREATE. Then filter IRP_MJ_SETINFORMATION to check if the file is
>>to
>>be deleted.
>>
>>“Bin Zeng” wrote in message news:xxxxx@ntfsd…
>> > Thanks for your reply.
>> >
>> > Because i need to change the filename when someone try to delete a
>> > file.
>> > how can i detect the “Delete” request in IRP_MJ_CREATE when someone
>> > try to delete the file with windows explorer?
>> >
>> > Regards
>> >
>> > Bin
>> >
>> >
>> >>From: “Shangwu”
>> >>Reply-To: “Windows File Systems Devs Interest List”
>>
>> >>To: “Windows File Systems Devs Interest List”
>> >>Subject: Re:[ntfsd] Detect FILE_DELETE_ON_CLOSE Problem
>> >>Date: Thu, 2 Feb 2006 17:20:49 -0500
>> >>
>> >>It is not always to delete a file by specifying that flag when the file
>>is
>> >>opened.
>> >>ZwSetInformationFile or its IRP can be used to delete files.
>> >>
>> >>“Bin Zeng” wrote in message news:xxxxx@ntfsd…
>> >> > Hi,Experts
>> >> >
>> >> > I try to detect the flag FILE_DELETE_ON_CLOSE in IRP_MJ_CREATE ,
>> >> >
>> >> > My code like the following:
>> >> >
>> >> > if( IrpSp->Parameters.Create.Options & FILE_DELETE_ON_CLOSE )
>> >> > {
>> >> > KdPrint((" delete the file on close flag = %wZ
>> >> > \n",&FileObject->FileName));
>> >> > }
>> >> >
>> >> > I delete the files, but I never get the print , even i try this in
>>the
>> >> > completion routine.
>> >> >
>> >> > Anyone can help ?
>> >> >
>> >> > Thanks
>> >> >
>> >> > Bin
>> >> >
>> >> >
>> >> >
>> >> >
>> >>
>> >>
>> >>
>> >>—
>> >>Questions? First check the IFS FAQ at
>> >>https://www.osronline.com/article.cfm?id=17
>> >>
>> >>You are currently subscribed to ntfsd as: xxxxx@hotmail.com
>> >>To unsubscribe send a blank email to xxxxx@lists.osr.com
>> >
>> >
>> >
>> >
>>
>>
>>
>>—
>>Questions? First check the IFS FAQ at
>>https://www.osronline.com/article.cfm?id=17
>>
>>You are currently subscribed to ntfsd as: xxxxx@hotmail.com
>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
>