identifying file delete during cut and paste

NTFSD
1

Hi,
When doing cut and paste a file to another drive - how can a minifilter identify that the file is deleted from the source volume?
FileDispositionInformation is sent only when a file is deleted and not during
cut and paste.
IRP_MJ_CLEANUP is being called several times …
Is there a single indication which may be used by the minifilter to identify the file deletion?
Thanks
Ron

2

Don’t think in terms of cut and paste: you’ll just cause yourself grief
because there is no way to detect it inside the kernel.

Is there a single indication which may be used by the minifilter to
identify the file deletion?

There are many ways (I can think of five but there will be more) that a file
can be deleted, not just SetDisposition. The most obvious that springs to
mind if DELETE_ON_CLOSE - are you sure that that isn’t being used?