on_after_filter_detach_from_volume Event

Fires after the filter detaches from a filesystem volume.

Syntax

class CBFilterAfterFilterDetachFromVolumeEventParams(object):
  @property
  def volume_name() -> str: ...
  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBFilter:
@property
def on_after_filter_detach_from_volume() -> Callable[[CBFilterAfterFilterDetachFromVolumeEventParams], None]: ...
@on_after_filter_detach_from_volume.setter
def on_after_filter_detach_from_volume(event_hook: Callable[[CBFilterAfterFilterDetachFromVolumeEventParams], None]) -> None: ...

Remarks

This event fires after the filter detaches from the filesystem volume specified by VolumeName, typically due to the volume being unmounted. Please refer to the fire_volume_events property for more information.

Applications only need to handle this event if the fire_volume_events property includes the FS_MOUNT_CONTROL flag. Please note that this event won't fire for any volumes skipped during the on_before_filter_attach_to_volume event; please refer to its documentation for more information.

Applications should use this event to remove volume-specific rules for the volume that has been unmounted. Applications that intend to do so must ensure that proper thread synchronization techniques are used when manipulating or enumerating the rule lists, since this event's handler will always execute in the context of some worker thread.

Applications must be aware that this event fires as a direct response to a filesystem state change (mount or unmount). Various system components or third-party actors are able to perform supplementary filesystem mounting and unmounting during main unmount operations (Volume Service is one of such components). This can cause seemingly excessive events to be fired, and sometimes they can even be fired out of order (such as two *Attach or *Detach events fired in a row).

The format of the VolumeName parameter's value depends on whether the ResolveNtDeviceToDriveLetter configuration setting is enabled; please refer to its documentation for more information. Applications can obtain additional information about a volume by retrieving its GUID using the get_volume_guid method, and then using that GUID to call various Windows API functions.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason (e.g., a resource isn't available, security checks failed, etc.), set it to a non-zero value to report an appropriate error. Please refer to the Error Reporting and Handling topic for more information.

This event is fired synchronously; please refer to the Event Types topic for more information.