9

I have an executable program (no source code) that creates temporary files in a certain folder then deletes them at the end. I am having trouble with the program and would like to examine the temporary files to see if there's anything I can do without changing the source.

Is there a way I can prevent the program from deleting files, or alternatively prevent all programs from deleting files in a certain folder?

Improve this question
2
  • 1
    Why not examine the files while the program is running? Does the program keep all of the temporary files it creates locked?
    – joeqwerty
    Jun 28, 2011 at 22:00
  • It creates them and deletes them too fast
    – JoelFan
    Jun 29, 2011 at 0:58

2 Answers 2

Reset to default
9

You can change the ACL on the folder in question so that the account running the executable (most likely you) can create, write, edit files in there, but not delete. Two issues:

  1. You would of course possibly cause the program to crash

  2. You will have to regain control of the folder afterwards (take ownership, reset all permissions etc) to be able to delete the files

Improve this answer
2
  • 4
    +1 With NTFS ACLs a Deny entry takes precedence over Allow. You can add an entry for Deny Delete and/or Deny Delete Subfolders/Files for Everyone onto the directory. We do this frequently to capture software installation extract/download files.
    – jscott
    Jun 28, 2011 at 21:37
  • 3
    @jscott: From MS: Inherited Deny permissions do not prevent access to an object if the object has an explicit Allow permission entry. Explicit permissions take precedence over inherited permissions, even inherited Deny permissions. technet.microsoft.com/en-us/library/cc736316(WS.10).aspx. The article is old but to my knowledge the behavior hasn't changed.
    – joeqwerty
    Jun 28, 2011 at 22:10
0

Since it's making the files, the user it's running as is the owner on the files and will be able to delete them, so I don't think there's anything you can configure for NTFS CACLS on the parent directory in advance.

You could try to open the files in another program yourself to see if that will prevent deletion. You could also try copying and/or moving the files as soon as they are created into another folder.

Improve this answer
2
  • 1
    Ownership overrides only one file permission - ability to change the object's ACLs. You can still deny yourself everything else (including even "Read permissions").
    – u1686_grawity
    Jun 28, 2011 at 21:48
  • unless of course you have set creator owner full control
    – tony roth
    Jun 28, 2011 at 21:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .