Correspondence between ProcMon and CreateFile disposition options

Question

Process Monitor shows disposition option for CreateFile operation as "Open", "OpenIf", "Overwrite", "OverwriteIf" (may be something else). How does the options which contain "If" differ from those that do not? And to which CreateFile WinAPI function 'dwCreationDisposition' flags do they correspond?

Answer 1

CreateFile() is the winapi function. Process Monitor however patches the native operating system, it only resembles the winapi in passing. It is pretty similar to VMS, the operating system that Dave Cutler designed when he still worked at DEC. Process Monitor hooks NtCreateFile, follow the link to see the CreateDisposition argument values documented. Copied:

• FILE_SUPERSEDE. If the file already exists, replace it with the given file. If it does not, create the given file.
• FILE_CREATE. If the file already exists, fail the request and do not create or open the given file. If it does not, create the given file.
• FILE_OPEN. If the file already exists, open it instead of creating a new file. If it does not, fail the request and do not create a new file.
• FILE_OPEN_IF. If the file already exists, open it. If it does not, create the given file.
• FILE_OVERWRITE. If the file already exists, open it and overwrite it. If it does not, fail the request.
• FILE_OVERWRITE_IF. If the file already exists, open it and overwrite it. If it does not, create the given file.