Note:
- NTFS - version 3.1 - used fsutil to obtain information
- Microsoft Windows XP [Version 5.1.2600]
Question:
- Method (or tool) to obtain, a list of files set for deletion during the next system restart?
There is a free MS/Sysinternals program called pendmoves that can show you the list of files waiting to be deleted/moved on reboot.
You can also look at the following registry key for a list of pending operations:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
The API operation that does this is called MoveFileEx() with the MOVEFILE_DELAY_UNTIL_REBOOT option.
More information in this KB.
FYI, to manually add a working entry to this area of the registry you can do the following:
Start REGEDT32 (W2K) or REGEDIT (WXP) and navigate to: HKLM\System\CurrentControlSet\Control\Session Manager
W2K: Edit, Add Value..., Data Type: REG_MULTI_SZ, Value Name: PendingFileRenameOperations, OK
WXP: Edit, New, Multi-String Value, [enter] PendingFileRenameOperations
- In the Data area, enter "\??\" + filename to be deleted. LFNs may be entered without being embedded in quotes. To delete "C:\Long Directory Name\Long File Name.exe", enter the following data:
\??\C:\Long Directory Name\Long File Name.exe
Then press OK.
- The "destination file name" is a null (zero) string. It is entered as follows:
W2K: Edit, Binary, select Data Format: Hex, click at the end of the hex string, enter 0000 (four zeros), OK.
WXP: Right-click the value, choose "Modify Binary Data", click at the end of the hex string, enter 0000 (four zeros), OK.
- Close REGEDT32/REGEDIT and reboot to delete the file.
From this thread.
Of course using movefile is easier than doing all that.