EldoS | Feel safer!

Software components for data protection, secure storage and transfer

Delete file events

Also by EldoS: CallbackDisk
Create virtual disks backed by memory or custom location, expose disk images as disks and more.
#34831
Posted: 10/20/2015 12:44:54
by Dennis  (Premium support level)
Joined: 10/20/2015
Posts: 20

Hello,
could you please advise how should I catch delete file events? As I understand OnPostCanFileBeDeletedC and CanFileBeDeletedC are raised then just check for possibility to delete file is done (even then file doesn't exist). And OnDeleteVirtualFile event handler is not called at all then physical file is deleted. I am kind of out of ideas how to trace the real deletion...

Thank you,
Dennis
#34833
Posted: 10/20/2015 13:33:45
by Vladimir Cherniga (EldoS Corp.)

Hello,
there are two different way the file may be deleted. One of them is using "set file disposition request" and the second, using special flags in file open request. First method is basically used in Windows XP, second method in later operation systems. CanFileBeDeleted event is triggered on a first method. In order to track file deletion with a second method read this help topic https://www.eldos.com/cbflt/articles/7923.php .
#34843
Posted: 10/21/2015 06:53:35
by Eugene Mayevski (EldoS Corp.)

Also you should note that our products may not be used in Russia, so please delete CallbackFilter and stop using it immediately.
#34845
Posted: 10/21/2015 08:04:22
by Dennis  (Premium support level)
Joined: 10/20/2015
Posts: 20

Quote
Eugene Mayevski wrote:
Also you should note that our products may not be used in Russia, so please delete CallbackFilter and stop using it immediately.

Thank you for information, Eugene. Our customers as well as virtual machines hosting your product all the way to production are all US-based. So no reason for worries.
As for my question - unfortunately there is no DeleteOnClose (0x04000000)flag set up in createoptions parameter of open file callback then deleting files. Only OpenReparsePoint (0x00200000) and Overlapped (0x40000000). Windows Server 2012. Am I missing something?

Thanks,
Dennis
#34848
Posted: 10/21/2015 09:50:36
by Eugene Mayevski (EldoS Corp.)

I’ve noticed there is no Support Access Ticket linked to your user account on EldoS site. Technical Support is provided to customers with the linked Support Access Ticket. You will find your Support Access Ticket together with all the details about how to use it in the registration e-mail that we’ve sent to you upon the purchase.

If you are evaluating the product and don't have a license yet, please let us know and then you can have support according to Basic support level. Basic support level includes answering basic technical questions that appear during product evaluation period. We also offer Premium support for a purchase from https://www.eldos.com/support/calc.php . You can use Premium Support to get higher level of assistance during your evaluation of our products.
#34849
Posted: 10/21/2015 10:13:50
by Dennis  (Premium support level)
Joined: 10/20/2015
Posts: 20

Quote
Eugene Mayevski wrote:
If you are evaluating the product and don't have a license yet, please let us know and then you can have support according to Basic support level.

Eugene, this is exactly our case - we have a trial version and evaluating it. Hopefully my question is covered by basic support level.
Thank you,
Dennis
#34852
Posted: 10/21/2015 12:06:21
by Vladimir Cherniga (EldoS Corp.)

Quote
Dennis wrote:
Am I missing something?

The file can be moved to recycle bin. Such event triggers a RenameOrMove callback. To get more information, I'd suggest to run ProcessMonitor tool from sysinternals.com and test the issue again. With that tool you may see all events happened under the specified filter mask.
#34880
Posted: 10/23/2015 11:43:29
by Dennis  (Premium support level)
Joined: 10/20/2015
Posts: 20

Thank you, good suggestion. ProcessMonitor really rocks. But I still have an issue with directory deletion event (empty directory is deleted on share). ProcessMonitor gives me the following operation for this folder: SetDispositionInformationFile (Delete: true). However I don't see corresponding event in your API. Could you please give me any clue?

Thanks,
Dennis
#34881
Posted: 10/23/2015 11:56:35
by Vladimir Cherniga (EldoS Corp.)

SetDispositionInformationFile corresponds to CbFltOnCanFileBeDeleted event.
#34889
Posted: 10/26/2015 10:37:24
by Dennis  (Premium support level)
Joined: 10/20/2015
Posts: 20

Hm.. does it mean there is no way to say for sure is directory going to be deleted or not (if there is locked file in it)? Both event types I catch during directory deletion: SetDispositionInformationFile (Delete: true) and CreateFile with desiredAccess = Delete don't suggest the final outcome.

Dennis
Also by EldoS: MsgConnect
Cross-platform protocol-independent communication framework for building peer-to-peer and client-server applications and middleware components.

Reply

Statistics

Topic viewed 7869 times

Number of guests: 1, registered members: 0, in total hidden: 0




|

Back to top

As of July 15, 2016 EldoS Corporation will operate as a division of /n software inc. For more information, please read the announcement.

Got it!