如何防止设备弹出/安全移除？

Question

How do I get a HANDLE to a file* on some device, and not prevent the user from ejecting the device?

I've tried calling CreateFile (and even NtCreateFile ) with the most liberal access I can think of -- ie FILE_READ_ATTRIBUTES for access, and FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE for sharing permissions, but it still doesn't work.

( FileTest is a great tool for testing this, without writing a program.)

---

*Update:

I'd really love the solution to work for handles to volumes or drives as well (not just files) -- I mean like \\\\.\\D: or \\\\.\\PhysicalDrive0 . But if there's no such solution, then handles to files would also be useful.

Answer 1

It should be clear that obtaining a file handle while a volume is mounted is trivial.

What happens when the volume is forcibly dismounted? All file handles become invalid. Attempts to use them return errors.

These code snippets forcibly dismounts a volume so that subsequent code can do direct i/o on it. This is excerpted from a disk cleaner utility (a mass consumer product) I wrote a few years back.

char    fn [20];

sprintf (fn, "\\\\.\\%s:", vol -> GetVolName ());
vol_lock_handle = CreateFile (fn, GENERIC_READ,
                FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
                OPEN_EXISTING,
                FILE_FLAG_NO_BUFFERING | FILE_FLAG_RANDOM_ACCESS,
                NULL);

fprintf (stderr,
 "Warning:  volume dismount will disrupt or kill all processes with open files!\n"
 "Before confirming, verify no critical processes have open files on volume %s:\n"
 "   Are you sure you want to dismount this volume? ('YES' to proceed)? ",
         g_vol -> GetVolName ());

char    buf [30];
if (!fgets (buf, sizeof buf, stdin)  ||  stricmp (buf, "yes\n"))
{
    fprintf (stderr, " Volume dismount not confirmed--canceled.\n");
    continue;
}
DWORD   status;
if (!DeviceIoControl (vol_lock_handle, FSCTL_DISMOUNT_VOLUME,
                        NULL, 0, NULL, 0, &status, NULL))
{
    DWORD err = GetLastError ();
    fprintf (stderr, "Error %d attempting to dismount volume: %s\n",
            err, w32errtxt (err));
}

I am perfectly aware of how wrong this code looks. A GENERIC_READ handle is obtained for dismounting, then obtaining a volume lock, and then written to. It works!

Answer 2

You cannot.

But what you can do is to watch for the eject device message and then close all the handles you have.

Device Events (MSDN)