file-iofilesystemsminifilterwindows-kernelwdf

Feasibility check for Filesystem Minifilter deletion Driver


I am using the delete minifilter example from msdn as a base: http://code.msdn.microsoft.com/windowshardware/Delete-File-System-b904651d

What I need to accomplish is:

  1. Getting a handle to a delete candidate in the DfPreCleanupCallback.
  2. In DfPostCleanupCallback - determining that the file should have been deleted if it wasn't for the handle acquired.
  3. Also in the DfPostCleanupCallback - Doing some operations on the file that would have been deleted and releasing the handle. Also assuring deletion the next time it enters IRP_MJ_CLEANUP to avoid infinite loop.

I have a very vague understanding of minifilters and the filter manager, so I would like to know if this is even possible in principle before I delve deeper into the minifilter world.

short version - I need a way to determine a file will be deleted without a doubt and do some operations on that file.


Solution

  • You need to do all processing in pre callback, because all delete related information promoted to FCB on cleanup.

    Getting a handle to a delete candidate in the DfPreCleanupCallback.

    Retriving handle in cleanup path is bad idea, because it`s lead to handle count incremention for file object, that in process of cleanup. Instead of this just use FILE_OBJECT, that was given to pre callback (in operations with FltReadFile for example).

    Doing some operations on the file that would have been

    After cleanup request reach fs, it set FO_CLEANUP_COMPLETE on FILE_OBJECT and you very limited in what you can do with it. Also ensuring of file deletion could be done in pre callback only.