0

I am using the delete minifilter example from msdn as a base: http://code.msdn.microsoft.com/windowshardware/Delete-File-System-b904651d

What I need to accomplish is:

  1. Getting a handle to a delete candidate in the DfPreCleanupCallback.
  2. In DfPostCleanupCallback - determining that the file should have been deleted if it wasn't for the handle acquired.
  3. Also in the DfPostCleanupCallback - Doing some operations on the file that would have been deleted and releasing the handle. Also assuring deletion the next time it enters IRP_MJ_CLEANUP to avoid infinite loop.

I have a very vague understanding of minifilters and the filter manager, so I would like to know if this is even possible in principle before I delve deeper into the minifilter world.

short version - I need a way to determine a file will be deleted without a doubt and do some operations on that file.

tshepang
  • 12,111
  • 21
  • 91
  • 136
ollo
  • 926
  • 1
  • 14
  • 33

2 Answers2

1

You need to do all processing in pre callback, because all delete related information promoted to FCB on cleanup.

Getting a handle to a delete candidate in the DfPreCleanupCallback.

Retriving handle in cleanup path is bad idea, because it`s lead to handle count incremention for file object, that in process of cleanup. Instead of this just use FILE_OBJECT, that was given to pre callback (in operations with FltReadFile for example).

Doing some operations on the file that would have been

After cleanup request reach fs, it set FO_CLEANUP_COMPLETE on FILE_OBJECT and you very limited in what you can do with it. Also ensuring of file deletion could be done in pre callback only.

Evgenii Gostiukhin
  • 970
  • 4
  • 8
  • As i understood, there are several things that can happen after pre cleanup callback that would cancel the delete operations ( race conditions that change the delete disposition state). This means I cannot determine a file will be deleted with a 100% certainty in the pre-callback. My idea was to get a handle to stop the cleanup from happening in the pre callback and then determine if it would have been deleted in the post callback - this way I could be sure nothing needs the file . – ollo Mar 27 '14 at 07:26
  • Just don`t do this. This is broken by design. You can`t be sure even after cleanup. Even after close for this FILE_OBJECT. There can be many FILE_OBJECTs for one file. – Evgenii Gostiukhin Mar 27 '14 at 10:12
0

As @izlesa commented, you cannot be sure without doubt the file is deleted in all circumstances. Mainly if the file was opened using Cache Manager, that could keep references to the file.

If your concern is delete its content, you can set its size to 0 before trying to delete it. Or wiping it. Or doing those things and moving to other hidden place.

Gonmator
  • 760
  • 6
  • 15