How do I prevent file deletion using callback rules?

Files are deleted by opening the file with DeleteOnClose flag set, then closing the file.

You need to handle file open operation using AddFilterCallbackRule() method with fltOpenCallback flag. Then in your callback / event handler, you need to modify flags in Options parameter to exclude DeleteOnClose flag.

Also, if you want to protect the files contents from being erased, you need to handle file creation and opening operation and inspect CreateDisposition parameter -- if TRUNCATE_EXISTING or CREATE_ALWAYS flag is passed, file contents can be overridden. In such case, you act accordingly (most likely deny the request).

Ready to get started?

Learn more about Callback Technologies or download a free trial.

Download Now