Here's a link to the original reporting of this class of bug: https://seclists.org/bugtraq/2000/May/67 In looking for how to deal with this problem on Windows, I discovered that .net core has essentially the same security bug. That file system node might have been a directory when FindNextFile returned it, but it's a symlink to c:\users now. Goodbye half your data (on average) before hitting a locked file. https://github.com/dotnet/corefx/issues/32082 Microsoft does not want to believe this is a security bug. I do not know what to do.