Let's say I have a Windows application that creates a file and writes data to it. The application has opened the file exclusively so no other processes can read the data in the file.
If the process is killed, the file is deleted.
If the process is suspended and the handle to the file is closed (using Process Explorer), the file is deleted.
It must be a feature of Windows that causes this, as no more code in the process is run because it's killed or suspended.
How can this be? What type of file exhibits this behaviour?
It's ok, I just found out.
It's FILE_FLAG_DELETE_ON_CLOSE
in dwFlagsAndAttributes
on the CreateFile
function.
Should have looked harder before asking the question :)
A "delete on close" filehandle.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With