Edit

FILE_DISPOSITION_INFORMATION_EX structure (ntddk.h)

  • Article

The FILE_DISPOSITION_INFORMATION_EX structure is used as an argument to the ZwSetInformationFile routine and indicates how the operating system should delete a file.

Syntax

typedef struct _FILE_DISPOSITION_INFORMATION_EX {
  ULONG Flags;
} FILE_DISPOSITION_INFORMATION_EX, *PFILE_DISPOSITION_INFORMATION_EX;

Members

Flags

Specifies what actions the system should take with a specific file while deleting.

Flag Name Value Meaning
FILE_DISPOSITION_DO_NOT_DELETE 0x00000000 Specifies the system should not delete a file.
FILE_DISPOSITION_DELETE 0x00000001 Specifies the system should delete a file.
FILE_DISPOSITION_POSIX_SEMANTICS 0x00000002 Specifies the system should perform a POSIX-style delete. See more info in Remarks.
FILE_DISPOSITION_FORCE_IMAGE_SECTION_CHECK 0x00000004 Specifies the system should force an image section check.
FILE_DISPOSITION_ON_CLOSE 0x00000008 Specifies if the system sets or clears the on-close state.
FILE_DISPOSITION_IGNORE_READONLY_ATTRIBUTE 0x00000010 Allows read-only files to be deleted. For more information, see the Remarks section below.

Remarks

The caller must have DELETE access to a given file to call ZwSetInformationFile with FILE_DISPOSITION_DELETE.

When FILE_DISPOSITION_POSIX_SEMANTICS is not set, a file marked for deletion is not actually deleted until all open handles for the file have been closed and the link count for the file is zero. When FILE_DISPOSITION_POSIX_SEMANTICS is set, the link is removed from the visible namespace as soon as the POSIX delete handle has been closed, but the file's data streams remain accessible by other existing handles until the last handle has been closed. That is, applications that already had the file open can still use their handle to read/write even though the name they used to open it is gone and the file's link count may have reached zero.

If the file is being deleted at user request, using POSIX semantics allows the system to delete the file as requested, but also allows any process with an open handle to continue to access the file's data as long as the handle is open.

A return value of STATUS_CANNOT_DELETE indicates that either the file is read-only, or there is an existing mapped view to the file.

Requirements

Requirement Value
Header ntddk.h (include Ntddk.h, Ntifs.h)

See also

ZwClose

ZwSetInformationFile