[cifs-protocol] What is FILE_ACTION_REMOVED_BY_DELETE? MS-FSCC 2.4.42

[Richard Sharpe]

On Mon, Jul 6, 2015 at 7:04 AM, Volker Lendecke
<Volker.Lendecke at sernet.de> wrote:
> Hello, Dochelp!
>
> MS-SMB2 2.2.36 SMB2 CHANGE_NOTIFY Response references
> FILE_NOTIFY_INFORMATION from MS-FSCC 2.4.42, which includes
> FILE_ACTION_REMOVED_BY_DELETE (value 9) as a possible
> action.
>
> I could not find a reference to the symbolic name in MS-FSA
> or MS-SMB2, the only reference google could find for me is a
> kernel API FsRtlNotifyFullReportChange:

It's described in MS-FSCC, 2.4.42 under FileNotifyInformation. I just
added support to Wireshark for dissecting the responses to Notify
requests. The description is terse.

> https://msdn.microsoft.com/en-us/library/windows/hardware/ff547041%28v=vs.85%29.aspx
>
> Question: Under what circumstances will we see
> FILE_ACTION_REMOVED_BY_DELETE on the wire, and in particular
> what is the difference to FILE_ACTION_REMOVED (value 2)?
>
> Thanks,
>
> Volker Lendecke
>
> --
> SerNet GmbH, Bahnhofsallee 1b, 37081 Göttingen
> phone: +49-551-370000-0, fax: +49-551-370000-9
> AG Göttingen, HRB 2816, GF: Dr. Johannes Loxen
> http://www.sernet.de, mailto:kontakt at sernet.de
> _______________________________________________
> cifs-protocol mailing list
> cifs-protocol at lists.samba.org
> https://lists.samba.org/mailman/listinfo/cifs-protocol



-- 
Regards,
Richard Sharpe
(何以解憂？唯有杜康。--曹操)