English 中文(简体)
截取 FileSytemCall 用于删除
原标题:Intercept FIleSytemCall for Deletion

在窗口执行删除前是否有一种方法可以检测删除文件的文件? 我找到了文件系统观察器类, 但事件只在删除动作执行后才会出现, 但是一旦用户/ 进程选择删除, 我想在删除动作后隐藏删除动作 。 您可以监视文件系统表格, 但寻找更好的方法 。 谢谢您的帮助 。

最佳回答

我认为最简单的方式是使用钩子来获得通知(并最终停止)过程。 它无法在. NET 中完成 。 所以您必须使用 < code> Dllimport 大量的结构, P/ Invoke 的功能很少 。

s 以 NtSetSetFileInformation (无记录) 函数开始您的工作。 当文件需要删除时, 它会被任何其他文件调用函数( 使用 FileDisposition Information 结构) 。

问题在于如何勾结该函数( 幸运, 它并不容易 ) 。 一个很好的选择可以是使用 < a href=" http://www. microsoftoft.com/ about/ about/ a/ a> 。 一个很好的选择可以是使用 < a href=" http://www. microsoft Detours/ iplicensing/ prographys/ programs/ detours. aspx" rel= “ http://www. microsoft Detours. com/ arts/ artrof=" http://www. codeproject. com/ arts/ artloadows/ rel= " API- Hooking- with- MS- Detours" rel= " nofolpol " > this 文章 < a > 。 问题在于它不是免费的。 。 替代方案( 价格合理, 与. NET 接口) 是 < a host I dontlear knowst.

问题回答

您需要一个文件系统过滤驱动程序。 但我强烈建议, 如果您不知道答案, 您可能不应该这样做 。

http://msdn.microsoft.com/en-us/library/windows/hardware/gg462968.aspx" rel=“no follow'>http://msdn.microsoft.com/en-us/library/windows/hardware/gg462968.aspx

也可以尝试 < 坚固 > ICopyHook < /坚固 > 界面 。

http://msdn.microsoft.com/en-us/library/windows/desktop/bb776049%28v=vs.85%29.aspx

在 wFunc 参数中 < 坚固> CopyCallback 方法使用 < 坚固 > FO_DELETE 来指定删除操作。

Disadvantage: Only prevent deletion in Windows Shell.





相关问题
Manually implementing high performance algorithms in .NET

As a learning experience I recently tried implementing Quicksort with 3 way partitioning in C#. Apart from needing to add an extra range check on the left/right variables before the recursive call, ...

Anyone feel like passing it forward?

I m the only developer in my company, and am getting along well as an autodidact, but I know I m missing out on the education one gets from working with and having code reviewed by more senior devs. ...

How do I compare two decimals to 10 decimal places?

I m using decimal type (.net), and I want to see if two numbers are equal. But I only want to be accurate to 10 decimal places. For example take these three numbers. I want them all to be equal. 0....

Exception practices when creating a SynchronizationContext?

I m creating an STA version of the SynchronizationContext for use in Windows Workflow 4.0. I m wondering what to do about exceptions when Post-ing callbacks. The SynchronizationContext can be used ...

Show running instance in single instance application

I am building an application with C#. I managed to turn this into a single instance application by checking if the same process is already running. Process[] pname = Process.GetProcessesByName("...

How to combine DataTrigger and EventTrigger?

NOTE I have asked the related question (with an accepted answer): How to combine DataTrigger and Trigger? I think I need to combine an EventTrigger and a DataTrigger to achieve what I m after: when ...

热门标签