AfterDeleteFile Event

Fires after a file or directory is deleted.


virtual int FireAfterDeleteFile(CBFilterAfterDeleteFileEventParams *e);
typedef struct {
const char *FileName;
void *FileContext;
void *HandleContext;
int ResultCode; int reserved; } CBFilterAfterDeleteFileEventParams;
virtual INT FireAfterDeleteFile(CBFilterAfterDeleteFileEventParams *e);
typedef struct {
LPVOID FileContext;
LPVOID HandleContext;
INT ResultCode; INT reserved; } CBFilterAfterDeleteFileEventParams;


This event fires after the file or directory specified by FileName is deleted. More specifically, this event is fired after the final IRP_MJ_CLOSE IRP is processed by the filesystem (i.e., after the last handle to the file or directory is closed and the file or directory is gone).

Note: This event is not fired when a virtual file is deleted; please refer to the Virtual Files topic for more information.

Applications only need to handle this event if they've added a standard filter rule that includes the FS_CE_AFTER_DELETE flag.

The FileContext and HandleContext parameters are placeholders for application-defined data associated with the file and specific handle, respectively. Please refer to the Contexts topic for more information.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason (e.g., a resource isn't available, security checks failed, etc.), set it to a non-zero value to report an appropriate error. Please refer to the Error Reporting and Handling topic for more information.

This event is fired synchronously; please refer to the Event Types topic for more information.

Copyright (c) 2021 Callback Technologies, Inc. - All rights reserved.
CBFS Filter 2020 C++ Edition - Version 20.0 [Build 7836]