What happens when DeleteFile API is called

NTFSD
1

If a user application calls DeleteFile API of Win32 what messages (Create, … Close etc.) are sent to filesystem driver?

2

wrote in message news:xxxxx@ntfsd…
> If a user application calls DeleteFile API of Win32 what messages
> (Create, … Close etc.) are sent to filesystem driver?
>

Get filespy and try this yourself. Bottom line is if you cannot do this
experiment on your own, you should not be doing file system work.

The above may sound harsh, but there is still a lot of things that have to
be determined by test and experimentation in Windows kernel programming.
And file system development has had many fewer drivers and practioners than
regular drivers. If you are not willing to experiment on your own, you
will probably not get a project done. Yes, the answer to the question
above is easy, but so is writing the test and getting the result yourself.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply

3

I get the answer.

By setting file information (IRP_MJ_SET_INFORMATION)
By openning the file with delete on close flag (I missed this one)

Sorry.

4

NtOpenFile with “delete on close” flag, then ZwClose

–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

wrote in message news:xxxxx@ntfsd…
> If a user application calls DeleteFile API of Win32 what messages (Create,
… Close etc.) are sent to filesystem driver?
>
>