Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss
What is FileSystem's IRP When deleting file
0 views
Skip to first unread message
TaeYoung
Aug 8, 2008, 12:49:01 PM8/8/08
to
I will protect my file where ntfs.
so, I want to know how can I protect my file.
When Filesystem delete file,what IRP is occured?
so, I want to know how can I protect my file.
When Filesystem delete file,what IRP is occured?
I want to capture IRP which deleting file.
Don Burn
Aug 8, 2008, 12:56:56 PM8/8/08
to
The call is an IRP_MJ_SET_INFORMATION with FileDispositionInformation. Of
course this call takes a file object so you need to monitor more to track
your file.
course this call takes a file object so you need to monitor more to track
your file.
--
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply
"TaeYoung" <TaeY...@discussions.microsoft.com> wrote in message
news:BEC642FB-ADD1-4A3E...@microsoft.com...
David Craig
Aug 8, 2008, 2:48:59 PM8/8/08
to
It can also be done with a CreateFile. Also a delete can be queued while
the file is opened that really occurs when the file is closed. Serveral
options to watch.
the file is opened that really occurs when the file is closed. Serveral
options to watch.
"Don Burn" <bu...@stopspam.windrvr.com> wrote in message
news:uXYUQfX%23IHA...@TK2MSFTNGP02.phx.gbl...
Maxim S. Shatskih
Aug 10, 2008, 2:29:25 PM8/10/08
to
> When Filesystem delete file,what IRP is occured?
MJ_CREATE with FILE_DELETE_ON_CLOSE
OR
MJ_SET_INFORMATION/FileDispositionInformation/DeleteOnClose == TRUE
--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
ma...@storagecraft.com
http://www.storagecraft.com
0 new messages