CBFS Filter 2020 Delphi Edition

Questions / Feedback?

BeforeCanFileBeDeleted Event

Fires before the OS attempts to mark a file or directory for deletion or remove such a mark.


type TBeforeCanFileBeDeletedEvent = procedure (
  Sender: TObject;
  const FileName: String;
  var CanDelete: Boolean;
  var FileContext: Pointer;
  var HandleContext: Pointer;
  var ProcessRequest: Boolean;
  var ResultCode: Integer
) of Object;

property OnBeforeCanFileBeDeleted: TBeforeCanFileBeDeletedEvent read FOnBeforeCanFileBeDeleted write FOnBeforeCanFileBeDeleted;


This event fires before the OS marks the file or directory specified by FileName for deletion or removes such a mark.

Files and directories can be deleted in two ways: a file or directory can be opened with the FILE_FLAG_DELETE_ON_CLOSE flag, or some process may call Windows API's NtSetInformationFile function with FILE_DISPOSITION_INFORMATION or FILE_DISPOSITION_INFORMATION_EX structure as a parameter.

Applications only need to handle this event if they've added a standard filter rule that includes the FS_CE_BEFORE_CAN_DELETE flag.

The CanDelete parameter specifies whether the file or directory will be deleted. This parameter can be True or False depending on which request the OS has sent. Applications may prevent deletion of the file or directory by setting CanDelete to False. Changing CanDelete from False to True may have or not have the effect on the file being deleted later, so such a change should be avoided.

The ProcessRequest parameter controls whether the request is sent onwards for further processing by subsequent filter drivers and the filesystem; it is True by default.

The effect of ProcessRequest depends on what operation caused the event to fire:

  • If the event fires during file open operation where the FILE_FLAG_DELETE_ON_CLOSE flag is set,
    • setting CanDelete to False and ProcessRequest to True causes the FILE_FLAG_DELETE_ON_CLOSE flag to be removed and the file open request to be passed further to the filesystem;
    • setting CanDelete to False and ProcessRequest to False causes the file open request to fail with ACCESS_DENIED error.
  • If the event fires in the context of the call to NtSetInformationFile Windows API function, setting CanDelete to False causes the DeleteFlag parameter to be set to False and the request to be passed further to the filesystem. This combination effectively resets the file deletion state, known to the filesystem, to the False ("do not delete") value. The value of ProcessRequest in this case doesn't matter as the new value must reach the filesystem.

The FileContext and HandleContext parameters are placeholders for application-defined data associated with the file and specific handle, respectively. Please refer to the Contexts topic for more information. (If the specified file or directory was not opened before the request, both contexts will be absent, in which case these parameters will be nil.)

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason (e.g., a resource isn't available, security checks failed, etc.), set it to a non-zero value to report an appropriate error. Please refer to the Error Reporting and Handling topic for more information.

This event is fired synchronously; please refer to the Event Types topic for more information.

Copyright (c) 2022 Callback Technologies, Inc. - All rights reserved.
CBFS Filter 2020 Delphi Edition - Version 20.0 [Build 8047]