When I Open a file, I receive IRP_CREATE, IRP_CLEANUP, and IRP_CLOSE

NTFSD
1

Hi,
I want to know wether there are opend files in a directory. I have tracked PRE_CLOSE, and I think the file with name of FltObjects->FileObject->FileName get in PRE_CLOSE is closed. But When I open a file, I can also received IRP_CLEANUP and IRP_CLOSE. What’s more, to my surprise, when I “close” the file, I can NOT receive IRP_CLEANUP and IRP_CLOSE. What’s wrong with my way? Thank U!

Best Wishes!

2

Read the IFS FAQ on the OSR Online site.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply

wrote in message news:xxxxx@ntfsd…
> Hi,
> I want to know wether there are opend files in a directory. I have
> tracked PRE_CLOSE, and I think the file with name of
> FltObjects->FileObject->FileName get in PRE_CLOSE is closed. But When I
> open a file, I can also received IRP_CLEANUP and IRP_CLOSE. What’s more,
> to my surprise, when I “close” the file, I can NOT receive IRP_CLEANUP
> and IRP_CLOSE. What’s wrong with my way? Thank U!
>
> Best Wishes!
>

3

Hi,
I have read the IFS FAQ, but I have not found the way related to my problem. But thank U all the same. Actually, I want to know wether there are opening files in a volume or directory.I want to track IRP_CLOSE, I think the file with the fileobject get in PRE_CLOSE is closed.

4

Becasue I want to compress a directory, but before compressing, all files in this directory must be closed, but I do NOT find a available way to know wether there are files opening in a directory. which IRP should I filter?

5

You cannot tell if a file is open in the directory because files need
not be opened via or relative to their directory.

Two examples of this:

  • I open the file by ID. This can be done relative to any directory on
    the volume (you can see this in the IFS Kit CDFS sample code, in fact.)
  • I create a hard link to the file (on NTFS or another file system that
    supports hard links) in which case the file is open but not by using
    this specific containing directory.

In addition, a driver below you can open a file without you ever being
aware of the open (c.f., IoCreateFileSpecifyDeviceObjectHint.)

To do what you are describing, you should build a file system driver.
You will then have insight into everyone/everything that has this opened
and can act accordingly. But in a filter driver, you are not in a
position to be able to know this information.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com