How do I prevent file deletion using callback rules?

Files are deleted by opening the file with the DeleteOnClose flag set, then closing the file.

You need to handle the file open operation using the AddFilterCallbackRule method with the fltOpenCallback flag. Then in your callback/event handler, you need to modify the flags in the Options parameter to exclude the DeleteOnClose flag.

Also, if you want to protect the files' contents from being erased, you need to handle the file creation and opening operations and inspect the CreateDisposition parameter — if theTRUNCATE_EXISTING or the CREATE_ALWAYS flag is passed, the file contents can be overridden. In such a case, you act accordingly (most likely deny the request).

Ready to get started?

Learn more about Callback Technologies or download a free trial.

Download Now