Hey, I would like to somehow identify the follow sequence of events (all performed by the same process )
Process reads a file
Process deletes the file
Process creates a new file
Process writes the content read before deletion to the new file
practically what I want to do with these events is perform some evaluation on the content in step 4, and if a certain condition is met rollback the file content to the content read in step 1
Whilst tracking step1-2 is fairly trivial , and the original content can be maintained through a stream handle context , I’m not sure how can I make it useable in steps 3-4 when a new handle is now in play
I know you can use file contexts but since there is a deletion involved in the sequence that won’t work either… any ideas ?
You have to make a technical definition as to what a "file" is.
A file name, including or not including files renamed/moved to that file name, define what a rename vs. move is, etc. at a low level, as atomic operations.
If it's a file name, you need your own tracking, none exist already to help you.
This is a super common question, but it its more than a little naive. Consider a Word document. User opens X.DOCX, deletes some of It, adds some more, and saves it. Is that the same file that he opened? Suppose he saves it with a different name? Is it the same file now? The potential permutations are endless. This is what Dejan is talking about. It depends on what you care about, for a specific, given, application.
You’re going to need to develop your own heuristic, based on what you care about, and that heuristic is going to need to be specific to the application(s) you care about.