Hi
I am sometimes seeing IRP_MJ_SET_INFORMATION for FileDispostionInformation
with DeleteFile FALSE.
There is a specific situation in which I often see this. I rename the
topleveldir of some directory tree. I see for some files often three or so
levels down the tree DeleteFile TRUE followed by DeleteFile FALSE; these
could be files which were recently - last few minutes say - closed in user
mode.
Does anyone have an idea why I see this curious behaviour? More generally
can anyone give any pointers/information as to when/why DeleteFile FALSE
is seen?
TIA - Lyndon
Cool. This will force people to write better filters.
-----Original Message-----
From: Lyndon J. Clarke [mailto:xxxxx@gcplc.com]
Sent: Thursday, November 14, 2002 1:09 PM
To: File Systems Developers
Subject: [ntfsd] Why do we see FileDispostionInformation DeleteFile
FALSE?
Hi
I am sometimes seeing IRP_MJ_SET_INFORMATION for FileDispostionInformation
with DeleteFile FALSE.
There is a specific situation in which I often see this. I rename the
topleveldir of some directory tree. I see for some files often three or so
levels down the tree DeleteFile TRUE followed by DeleteFile FALSE; these
could be files which were recently - last few minutes say - closed in user
mode.
Does anyone have an idea why I see this curious behaviour? More generally
can anyone give any pointers/information as to when/why DeleteFile FALSE
is seen?
TIA - Lyndon
You are currently subscribed to ntfsd as: xxxxx@inin.com
To unsubscribe send a blank email to %%email.unsub%%
Hi
Cool. This will force people to write better filters.
It sure has stopped me in my tracks 
Seriously any information about this would be great!
TIA - Lyndon
You will see DeleteFile FALSE when someone is trying to make sure that a
file which was previously marked for deletion is not deleted.
Are you running with other filters? Off the top of my head, I don’t
know of any user applications that would mark a file for deletion, then
unmark it later. I do know of a number of file system filters that do
such things, such as undelete filters and the System Restore filter in
Windows XP. When a user deletes a file these types of filters don’t
really want the file to be deleted. Instead they will rename the file
to a special location in case the user wants the file delete to be
undone later.
A filter may also send a DeleteFile FALSE if the filter needs to get
another handle to the file. The file system and object manager will not
allow anyone to open the file again or get a handle by calling
ObOpenObjectByPointer. If the filter needs a handle, it can send down
an IRP_MJ_SET_INFORMATION, FileDispositionInformatio with DeleteFile
FALSE, get the handle to the file, then send down another
IRP_MJ_SET_INFORMATION, FileDispositionInformatio with DeleteFile TRUE.
Molly Brown
Microsoft Corporation
This posting is provided “AS IS” with no warranties and confers no
rights.
-----Original Message-----
From: Lyndon J. Clarke [mailto:xxxxx@gcplc.com]
Sent: Thursday, November 14, 2002 10:09 AM
To: File Systems Developers
Subject: [ntfsd] Why do we see FileDispostionInformation DeleteFile
FALSE?
Hi
I am sometimes seeing IRP_MJ_SET_INFORMATION for
FileDispostionInformation with DeleteFile FALSE.
There is a specific situation in which I often see this. I rename the
topleveldir of some directory tree. I see for some files often three or
so levels down the tree DeleteFile TRUE followed by DeleteFile FALSE;
these could be files which were recently - last few minutes say - closed
in user mode.
Does anyone have an idea why I see this curious behaviour? More
generally can anyone give any pointers/information as to when/why
DeleteFile FALSE is seen?
TIA - Lyndon
You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to %%email.unsub%%
Hi Molly
Thanks for this helpful reply.
I do have a filter in the stack. There is one and only one. It is my
filter where I am seeing DeleteFile FALSE. I apologise. I should have made
this clear in the original posting.
So really I am wondering when I can see DeleteFile FALSE which is not from
a filter.
TIA - Lyndon