[cifs-protocol] What is FILE_ACTION_REMOVED_BY_DELETE? MS-FSCC 2.4.42

[Tarun Chopra]

Thanks Richard for the pointer. 

Hello Volker - As Richard pointed out; the information is stated in section 2.4.42 of MS-FSCC. Kindly let us know if you need any further assistance.

Thanks
Tarun Chopra.

-----Original Message-----
From: Richard Sharpe [mailto:realrichardsharpe at gmail.com] 
Sent: Monday, July 6, 2015 7:11 AM
To: Volker Lendecke
Cc: Interoperability Documentation Help; cifs-protocol at lists.samba.org
Subject: Re: [cifs-protocol] What is FILE_ACTION_REMOVED_BY_DELETE? MS-FSCC 2.4.42

On Mon, Jul 6, 2015 at 7:04 AM, Volker Lendecke <Volker.Lendecke at sernet.de> wrote:
> Hello, Dochelp!
>
> MS-SMB2 2.2.36 SMB2 CHANGE_NOTIFY Response references 
> FILE_NOTIFY_INFORMATION from MS-FSCC 2.4.42, which includes 
> FILE_ACTION_REMOVED_BY_DELETE (value 9) as a possible action.
>
> I could not find a reference to the symbolic name in MS-FSA or 
> MS-SMB2, the only reference google could find for me is a kernel API 
> FsRtlNotifyFullReportChange:

It's described in MS-FSCC, 2.4.42 under FileNotifyInformation. I just added support to Wireshark for dissecting the responses to Notify requests. The description is terse.

> https://msdn.microsoft.com/en-us/library/windows/hardware/ff547041%28v
> =vs.85%29.aspx
>
> Question: Under what circumstances will we see 
> FILE_ACTION_REMOVED_BY_DELETE on the wire, and in particular what is 
> the difference to FILE_ACTION_REMOVED (value 2)?
>
> Thanks,
>
> Volker Lendecke
>
> --
> SerNet GmbH, Bahnhofsallee 1b, 37081 Göttingen
> phone: +49-551-370000-0, fax: +49-551-370000-9 AG Göttingen, HRB 2816, 
> GF: Dr. Johannes Loxen http://www.sernet.de, mailto:kontakt at sernet.de 
> _______________________________________________
> cifs-protocol mailing list
> cifs-protocol at lists.samba.org
> https://lists.samba.org/mailman/listinfo/cifs-protocol



--
Regards,
Richard Sharpe
(何以解憂？唯有杜康。--曹操)