Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an executable program (no source code) that creates temporary files in a certain folder then deletes them at the end. I am having trouble with the program and would like to examine the temporary files to see if there's anything I can do without changing the source.

Is there a way I can prevent the program from deleting files, or alternatively prevent all programs from deleting files in a certain folder?

share|improve this question
1  
Why not examine the files while the program is running? Does the program keep all of the temporary files it creates locked? –  joeqwerty Jun 28 '11 at 22:00
    
It creates them and deletes them too fast –  JoelFan Jun 29 '11 at 0:58
    
Gotcha. Thanks for the update. –  joeqwerty Jun 29 '11 at 1:39

2 Answers 2

up vote 8 down vote accepted

You can change the ACL on the folder in question so that the account running the executable (most likely you) can create, write, edit files in there, but not delete. Two issues:

  1. You would of course possibly cause the program to crash

  2. You will have to regain control of the folder afterwards (take ownership, reset all permissions etc) to be able to delete the files

share|improve this answer
3  
+1 With NTFS ACLs a Deny entry takes precedence over Allow. You can add an entry for Deny Delete and/or Deny Delete Subfolders/Files for Everyone onto the directory. We do this frequently to capture software installation extract/download files. –  jscott Jun 28 '11 at 21:37
1  
@jscott: From MS: Inherited Deny permissions do not prevent access to an object if the object has an explicit Allow permission entry. Explicit permissions take precedence over inherited permissions, even inherited Deny permissions. technet.microsoft.com/en-us/library/cc736316(WS.10).aspx. The article is old but to my knowledge the behavior hasn't changed. –  joeqwerty Jun 28 '11 at 22:10

Since it's making the files, the user it's running as is the owner on the files and will be able to delete them, so I don't think there's anything you can configure for NTFS CACLS on the parent directory in advance.

You could try to open the files in another program yourself to see if that will prevent deletion. You could also try copying and/or moving the files as soon as they are created into another folder.

share|improve this answer
1  
Ownership overrides only one file permission - ability to change the object's ACLs. You can still deny yourself everything else (including even "Read permissions"). –  grawity Jun 28 '11 at 21:48
    
unless of course you have set creator owner full control –  tony roth Jun 28 '11 at 21:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.