Re:Re:Detect FILE_DELETE_ON_CLOSE Problem

Hi,Shangwu

Thanks for your reply. You are right, but the point is how i know this file
will be
deleted without the flag “FILE_DELETE_ON_CLOSE” in IRP_MJ_CREATE ?

And what’s different for “rename” and “delete” a file in IRP_MJ_CREATE ?

I need to detect the file delete in IRP_MJ_CREATE, not in
IRP_MJ_SETINFORMATION .

Is it possible to do that?

Thanks

Bin

From: “Shangwu”
>Reply-To: “Windows File Systems Devs Interest List”
>To: “Windows File Systems Devs Interest List”
>Subject: Re:[ntfsd] Re:Detect FILE_DELETE_ON_CLOSE Problem
>Date: Thu, 2 Feb 2006 18:03:23 -0500
>
>You need save the file object pointer in which you are interested under
>IRP_MJ_CREATE. Then filter IRP_MJ_SETINFORMATION to check if the file is to
>be deleted.
>
>“Bin Zeng” wrote in message news:xxxxx@ntfsd…
> > Thanks for your reply.
> >
> > Because i need to change the filename when someone try to delete a file.
> > how can i detect the “Delete” request in IRP_MJ_CREATE when someone
> > try to delete the file with windows explorer?
> >
> > Regards
> >
> > Bin
> >
> >
> >>From: “Shangwu”
> >>Reply-To: “Windows File Systems Devs Interest List”
>
> >>To: “Windows File Systems Devs Interest List”
> >>Subject: Re:[ntfsd] Detect FILE_DELETE_ON_CLOSE Problem
> >>Date: Thu, 2 Feb 2006 17:20:49 -0500
> >>
> >>It is not always to delete a file by specifying that flag when the file
>is
> >>opened.
> >>ZwSetInformationFile or its IRP can be used to delete files.
> >>
> >>“Bin Zeng” wrote in message news:xxxxx@ntfsd…
> >> > Hi,Experts
> >> >
> >> > I try to detect the flag FILE_DELETE_ON_CLOSE in IRP_MJ_CREATE ,
> >> >
> >> > My code like the following:
> >> >
> >> > if( IrpSp->Parameters.Create.Options & FILE_DELETE_ON_CLOSE )
> >> > {
> >> > KdPrint((" delete the file on close flag = %wZ
> >> > \n",&FileObject->FileName));
> >> > }
> >> >
> >> > I delete the files, but I never get the print , even i try this in
>the
> >> > completion routine.
> >> >
> >> > Anyone can help ?
> >> >
> >> > Thanks
> >> >
> >> > Bin
> >> >
> >> >
> >> >
> >> >
> >>
> >>
> >>
> >>—
> >>Questions? First check the IFS FAQ at
> >>https://www.osronline.com/article.cfm?id=17
> >>
> >>You are currently subscribed to ntfsd as: xxxxx@hotmail.com
> >>To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >
> >
> >
>
>
>
>—
>Questions? First check the IFS FAQ at
>https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: xxxxx@hotmail.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com