EldoS | Feel safer!

Software components for data protection, secure storage and transfer

Close upon delete?

Also by EldoS: SecureBlackbox
200+ components and classes for digital security, signing, encryption and secure networking.
Posted: 10/17/2008 12:19:09
by Sid Schipper (Standard support level)
Joined: 03/14/2008
Posts: 285

If you open a file on your Virtual Disk in notepad and the go to a different Windows Explorer window and delete the same file, will you see a call to both the CbFsDeleteFile callback and the CbFsCloseFile callback? Or will this produce some sort of error?
Posted: 10/17/2008 15:05:44
by Constantin Scheder (Basic support level)
Joined: 09/19/2008
Posts: 3

Furthermore, it seems that CBFS (or the Windows Cache manager or something) is still holding open file handles even AFTER a file was deleted. What is the danger of those file handles from the deleted file being used again - maybe in a subsequent read, write, or close?
Posted: 10/18/2008 02:41:26
by Volodymyr Zinin (Team)

I've checked it and not found any problem. Notepad don't hold an opened file in the opened state. I.e. it opens a file, reads it and then closes. When it's necessary to write modified data then Notepad opens the file on a disk again and writes data to it. That's why it's possible to delete an opened in Notepad file.
The problem can occur if at the time of deletion the file is also opened by someone another. In this case the file will be deleted only after the latest handle is closed. And only in this time the pair of OnDelete+OnClose callbacks will be called.
You can see all operations performed on a file using FileMonitor from sysinternals.com. Also you can check what process is still holding the file in the opened state using the sysinternals' ProcessExplorer (in it's menu there is an feature "Find handle or dll...").

Constantin Scheder wrote:
What is the danger of those file handles from the deleted file being used again - maybe in a subsequent read, write, or close?

When a file is being deleted then it's marked as "pending for deletion" and it will be deleted only when the latest handle to it is closed. Such marked file can't be opened by another process. But it still can be read or written, and even unmarked for deletion. This is how file systems in Windows work. CallbackFS doesn't add something to this mechanism.



Topic viewed 3509 times

Number of guests: 1, registered members: 0, in total hidden: 0


Back to top

As of July 15, 2016 EldoS business operates as a division of /n software, inc. For more information, please read the announcement.

Got it!