AfterCanFileBeDeleted Event

Fires after the OS marks a file or directory for deletion or removes such a mark.

Syntax

ANSI (Cross Platform)
virtual int FireAfterCanFileBeDeleted(CBFilterAfterCanFileBeDeletedEventParams *e);
typedef struct {
const char *FileName;
int CanDelete;
int Status;
void *FileContext;
void *HandleContext;
int ResultCode; int reserved; } CBFilterAfterCanFileBeDeletedEventParams; Unicode (Windows) virtual INT FireAfterCanFileBeDeleted(CBFilterAfterCanFileBeDeletedEventParams *e);
typedef struct {
LPCWSTR FileName;
BOOL CanDelete;
INT Status;
LPVOID FileContext;
LPVOID HandleContext;
INT ResultCode; INT reserved; } CBFilterAfterCanFileBeDeletedEventParams;
#define EID_CBFILTER_AFTERCANFILEBEDELETED 1

virtual INT CBFSFILTER_CALL FireAfterCanFileBeDeleted(LPWSTR &lpszFileName, BOOL &bCanDelete, INT &iStatus, LPVOID &lpFileContext, LPVOID &lpHandleContext, INT &iResultCode);

Remarks

This event fires after the OS marks the file or directory specified by FileName for deletion or removes such a mark. If the file or directory is marked for deletion, they will be actually removed not immediately but when the last handle is closed. Moreover, it is possible that a future call to a system function will remove the mark, so this event is not a final indicator that the file or directory will be deleted.

Files and directories can be deleted in two ways: a file or directory can be opened with the FILE_FLAG_DELETE_ON_CLOSE flag, or some process may call Windows API's NtSetInformationFile function with FILE_DISPOSITION_INFORMATION or FILE_DISPOSITION_INFORMATION_EX structure as a parameter.

Applications only need to handle this event if they've added a standard filter rule that includes the FS_CE_AFTER_CAN_DELETE flag.

The CanDelete parameter reflects whether the file or directory will be deleted.

The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the NtStatusToWin32Error method. Please note that this event won't fire for failed requests unless the ProcessFailedRequests property is enabled. Applications may change this parameter's value if they want a different NT status code to be returned.

The FileContext and HandleContext parameters are placeholders for application-defined data associated with the file and specific handle, respectively. Please refer to the Contexts topic for more information.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason (e.g., a resource isn't available, security checks failed, etc.), set it to a non-zero value to report an appropriate error. Please refer to the Error Reporting and Handling topic for more information.

This event is fired synchronously; please refer to the Event Types topic for more information.

Copyright (c) 2022 Callback Technologies, Inc. - All rights reserved.
CBFS Filter 2020 C++ Edition - Version 20.0 [Build 8317]