Why do we see FileDispostionInformation DeleteFile FALSE?

Hi

I am sometimes seeing IRP_MJ_SET_INFORMATION for FileDispostionInformation
with DeleteFile FALSE.

There is a specific situation in which I often see this. I rename the
topleveldir of some directory tree. I see for some files often three or so
levels down the tree DeleteFile TRUE followed by DeleteFile FALSE; these
could be files which were recently - last few minutes say - closed in user
mode.

Does anyone have an idea why I see this curious behaviour? More generally
can anyone give any pointers/information as to when/why DeleteFile FALSE
is seen?

TIA - Lyndon

Cool. This will force people to write better filters.

-----Original Message-----
From: Lyndon J. Clarke [mailto:xxxxx@gcplc.com]
Sent: Thursday, November 14, 2002 1:09 PM
To: File Systems Developers
Subject: [ntfsd] Why do we see FileDispostionInformation DeleteFile
FALSE?

Hi

I am sometimes seeing IRP_MJ_SET_INFORMATION for FileDispostionInformation
with DeleteFile FALSE.

There is a specific situation in which I often see this. I rename the
topleveldir of some directory tree. I see for some files often three or so
levels down the tree DeleteFile TRUE followed by DeleteFile FALSE; these
could be files which were recently - last few minutes say - closed in user
mode.

Does anyone have an idea why I see this curious behaviour? More generally
can anyone give any pointers/information as to when/why DeleteFile FALSE
is seen?

TIA - Lyndon


You are currently subscribed to ntfsd as: xxxxx@inin.com
To unsubscribe send a blank email to %%email.unsub%%

Hi

Cool. This will force people to write better filters.

It sure has stopped me in my tracks :wink:

Seriously any information about this would be great!

TIA - Lyndon

You will see DeleteFile FALSE when someone is trying to make sure that a
file which was previously marked for deletion is not deleted.

Are you running with other filters? Off the top of my head, I don’t
know of any user applications that would mark a file for deletion, then
unmark it later. I do know of a number of file system filters that do
such things, such as undelete filters and the System Restore filter in
Windows XP. When a user deletes a file these types of filters don’t
really want the file to be deleted. Instead they will rename the file
to a special location in case the user wants the file delete to be
undone later.

A filter may also send a DeleteFile FALSE if the filter needs to get
another handle to the file. The file system and object manager will not
allow anyone to open the file again or get a handle by calling
ObOpenObjectByPointer. If the filter needs a handle, it can send down
an IRP_MJ_SET_INFORMATION, FileDispositionInformatio with DeleteFile
FALSE, get the handle to the file, then send down another
IRP_MJ_SET_INFORMATION, FileDispositionInformatio with DeleteFile TRUE.

Molly Brown
Microsoft Corporation

This posting is provided “AS IS” with no warranties and confers no
rights.

-----Original Message-----
From: Lyndon J. Clarke [mailto:xxxxx@gcplc.com]
Sent: Thursday, November 14, 2002 10:09 AM
To: File Systems Developers
Subject: [ntfsd] Why do we see FileDispostionInformation DeleteFile
FALSE?

Hi

I am sometimes seeing IRP_MJ_SET_INFORMATION for
FileDispostionInformation with DeleteFile FALSE.

There is a specific situation in which I often see this. I rename the
topleveldir of some directory tree. I see for some files often three or
so levels down the tree DeleteFile TRUE followed by DeleteFile FALSE;
these could be files which were recently - last few minutes say - closed
in user mode.

Does anyone have an idea why I see this curious behaviour? More
generally can anyone give any pointers/information as to when/why
DeleteFile FALSE is seen?

TIA - Lyndon


You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to %%email.unsub%%

Hi Molly

Thanks for this helpful reply.

I do have a filter in the stack. There is one and only one. It is my
filter where I am seeing DeleteFile FALSE. I apologise. I should have made
this clear in the original posting.

So really I am wondering when I can see DeleteFile FALSE which is not from
a filter.

TIA - Lyndon