when and how place a file downloaded success by IE to another path

NTFSD
1

Hi everyone.
I want to know the time when a file has downloaded successfully by IE in minifilter.After i know the time ,i need to place this file to another use some ways. In fact, i am not sure use which ways.
Using Process Monitor,i find that
Event Class: File System
Operation: CloseFile
Result: SUCCESS
Path: C:\SecureZone\Stud_PE.rar
when this line appear,it may be say this file has downloaded successfully.But I don’t know when Operation “CloseFile” situation happen.Is it in pre IRP_MJ_CLOSE or post IRP_MJ_CLOSE?
Another question. how to place C:\SecureZone\Stud_PE.rar to E:\OldMapping\Stud_PE.rar in instantly? Using Rename technique?
please someone give me advices.
thanks in advance.

2

You can enable “Advanced Output” and you’ll see actual IRP names instead of the friendly names like “CloseFile”. Anyway, in general in ProcMon you will see the “preOp”.

The problem with replacing using rename is that it doesn’t work across volumes. In fact, there is no way to do this instantly across volumes (the data must be copied at some point from one volume to the other). You could copy the file from one volume to another with a temporary name and then once it’s on the same volume as the target you could rename it in an atomic fashion.

Thanks,
Alex.

3

thanks for your help.

4

I found “CloseFile” operation is IRP_MJ_CLEANUP.But now ,i meet another question that how to obtain file’s full path include volume name in pre IRP_MJ_CLEANUP or post IRP_MJ_CLEANUP .
Data->Iopb->TargetFileObject->FileName is SecureZone\Stud_PE.rar, i want to get \Device\HarddiskVolume1\SecureZone\Stud_PE.rar by FltGetFileNameInformation as ProMon ,but get a error status.this function can’t work.How to get full path?
And also,i need to get Result: SUCCESS.

thanks a lot
jamie

5

anyone can help me ??

6

I was under the impression that FltGetFIleNameInformation works in preCleanup. Nevertheless you can get the file name before then (IIRC you said there is a rename operation for the file after it’s downloaded so you could get the name then).

Thanks,
Alex.