Feasibility check for Filesystem Minifilter deletion Driver

Question

I am using the delete minifilter example from msdn as a base: http://code.msdn.microsoft.com/windowshardware/Delete-File-System-b904651d

What I need to accomplish is:

1. Getting a handle to a delete candidate in the DfPreCleanupCallback.
2. In DfPostCleanupCallback - determining that the file should have been deleted if it wasn't for the handle acquired.
3. Also in the DfPostCleanupCallback - Doing some operations on the file that would have been deleted and releasing the handle. Also assuring deletion the next time it enters IRP_MJ_CLEANUP to avoid infinite loop.

I have a very vague understanding of minifilters and the filter manager, so I would like to know if this is even possible in principle before I delve deeper into the minifilter world.

short version - I need a way to determine a file will be deleted without a doubt and do some operations on that file.

Answer 1

You need to do all processing in pre callback, because all delete related information promoted to FCB on cleanup.

Getting a handle to a delete candidate in the DfPreCleanupCallback.

Retriving handle in cleanup path is bad idea, because it`s lead to handle count incremention for file object, that in process of cleanup. Instead of this just use FILE_OBJECT, that was given to pre callback (in operations with FltReadFile for example).

Doing some operations on the file that would have been

After cleanup request reach fs, it set FO_CLEANUP_COMPLETE on FILE_OBJECT and you very limited in what you can do with it. Also ensuring of file deletion could be done in pre callback only.

Answer 2

As @izlesa commented, you cannot be sure without doubt the file is deleted in all circumstances. Mainly if the file was opened using Cache Manager, that could keep references to the file.

If your concern is delete its content, you can set its size to 0 before trying to delete it. Or wiping it. Or doing those things and moving to other hidden place.