irp for delete file

hi,

i would like to know which irp will be issued when a delete operation is performed on a file. especially when we call a ZwDelete.

> i would like to know which irp will be issued when a delete

operation is performed on a file. especially when we call a ZwDelete.

IRP_MJ_SET_INFORMATION

L.

Be careful - this is a more complex interaction than you might think
based upon looking at the user APIs.

IRP_MJ_SET_INFORMATION (FileDispositionInformation) is used to control
the pending state of deletion on a specific link to the file.
IRP_MJ_CLEANUP will process a pending deletion on the link to the file
if it is the last open instance of the file.
IRP_MJ_CREATE (FILE_DELETE_ON_CLOSE set in the options) will set the
initial disposition to be “pending deletion”.

Thus, there are some interactions to consider here:

  • Disposition can be changed. If the disposition is set using
    IRP_MJ_SET_INFORMATION it can be changed on any of the Windows FS
    currently shipping (e.g., you’ll have to wait on Vista - it’s still
    technically under NDA and thus we’re not allowed to disclose such
    information yet.) However, if it is set using the IRP_MJ_CREATE
    approach, this cannot be reversed on FAT, but can be on NTFS.

  • Files that have multiple links to them continue to exist until the
    last link to the file is deleted.

  • Files object that are created by using open by file IDs or object IDs
    do not allow setting the disposition.

  • Multiple open instances allow the LAST closer of the file to change
    its disposition, even if a different open instance was used to mark the
    file for delete pending.

  • The file really cannot be deleted until the IRP_MJ_CLOSE is processed.
    There are complex interactions between the VM system (cache manager and
    memory manager) and the FSD with respect to deletion - they have to “let
    go” before the file can safely be deleted. Thus, files do not
    automatically “go away” when the IRP_MJ_CLEANUP arrives.

This is significantly different than the POSIX “unlink” semantic, where
the link from the directory “goes away” but the file (and contents)
remain on disk. It also does not mesh well with what you might expect
from looking at a higher level function that wraps this up for you.

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@patni.com
Sent: Wednesday, September 06, 2006 10:30 PM
To: ntfsd redirect
Subject: [ntfsd] irp for delete file

hi,

i would like to know which irp will be issued when a delete operation is
performed on a file. especially when we call a ZwDelete.


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

IRP_MJ_SET_INFORMATION/FileDispositionInformation
Or the file can be opened with “delete on close” flag, and then closed.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From:
To: “Windows File Systems Devs Interest List”
Sent: Thursday, September 07, 2006 9:30 AM
Subject: [ntfsd] irp for delete file

> hi,
>
> i would like to know which irp will be issued when a delete operation is
performed on a file. especially when we call a ZwDelete.
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com