OSRLogoOSRLogoOSRLogo x Subscribe to The NT Insider

Everything Windows Driver Development

GoToHomePage xLoginx

    Thu, 14 Mar 2019     118020 members


  Online Dump Analyzer
OSR Dev Blog
The NT Insider
The Basics
File Systems
ListServer / Forum
  Express Links
  · The NT Insider Digital Edition - May-June 2016 Now Available!
  · Windows 8.1 Update: VS Express Now Supported
  · HCK Client install on Windows N versions
  · There's a WDFSTRING?
  · When CAN You Call WdfIoQueueP...ously

How Are Files Deleted In Windows

A file or directory is deleted when a deletion request is pending and the last user reference to the file is released (that is, the last IRP_MJ_CLEANUP is sent to the file system).


Deletion is requested on a file or directory in one of two ways:


  • When the file/directory is opened, FILE_DELETE_ON_CLOSE is set.  The exact semantics of this are complicated because the file systems explicitly check for this, explicitly add DELETE access to the access required (even if not requested originally) and must deal with issues regarding directories (a directory must be empty before it can be marked delete pending).
  • For an already opened file/directory, the IRP_MJ_SET_INFORMATION, specifying FileDispositionInformation and then providing the FILE_DISPOSITION_INFORMATION structure indicating TRUE for the DeleteFile field.


In these cases the file is now scheduled for deletion, but that can be changed by a subsequent call to modify the file disposition (indicating FALSE for the DeleteFile field.)


Note that the EXACT semantics are file system specific.  Do not be surprised if you see some differences in the seven general purpose file systems currently available from Microsoft.  For example, CDFS and UDFS currently do not allow you to delete files (note the term "currently" - were Microsoft to provide a read/write UDF file system, then we suspect these semantics would change.)  NFS semantics are very different than CIFS semantics for deletion.  Similarly, the semantics of the Netware File System are also unclear.

User Comments
Rate this article and give us feedback. Do you find anything missing? Share your opinion with the community!
Post Your Comment

"unix like delete"
Just in case you're porting unix application code (and I will wash my mouth out with soap right after this) that assumes the unix delete semantics, lets be explict about it. This means its not sufficient to delete a file, it may not be deleted immediately, and this may cause problems in deleting directories and/or creating a new file of the same name.

But you can closely simulate unix semantics by renaming the file to a temporary directory and scheduling it for deletion.

18-Aug-03, Jack Heeley

Post Your Comments.
Print this article.
Email this article.
bottom nav links