DeleteFile

• The DeleteFile function marks a file for deletion on close.
• 表明DeleteFile仅是标记此文件可以删除，而不是立刻删除此文件
• Therefore, the file deletion does not occur until the last handle to the file is closed.
• 表明如果文件没有再DeleteFile之后立刻删除，则可能是还有句柄占用此文件
• Subsequent calls to CreateFile to open the file fail with ERROR_ACCESS_DENIED.
• 表明如果被Mask DeleteFile的文件再次被打开，是不允许的
• Symbolic link behavior – If the path points to a symbolic link, the symbolic link is deleted, not the target.
• Symbolic所连接的文件DeleteFile时仅是删掉了link
• To delete a target, you must call CreateFile and specify FILE_FLAG_DELETE_ON_CLOSE.
• 如果希望通过软连接删掉Target File，则需要在创建Target File时执行Flag，但是deletion的行为也仅是在文件句柄drop on zero时，才会deleteFile

疑问：

• 遇到过DeleteFile之后，锁定文件所在Partition失败的情况，LastCode=5。此处可能是DeleteFile的底层行为导致的。可能DeleteFile仅是mask，而没有立刻删除，删除时机有系统控制，所以才导致锁盘失败

工具：

• https://github.com/Microsoft/Windows-driver-samples/tree/master/filesys/miniFilter/delete