IRP_MJ_VOLUME_MOUNT vs IRP_MJ_FILE_SYSTEM_CONTROL

NTFSD
1

Hi, guys

What I’ve been fooling around with is what is the diffence between IRP_MJ_VOLUME_MOUNT and IRP_MJ_FILE_SYSTEM_CONTROL.IRP_MN_MOUNT_VOLUME.

Is IRP_MJ_VOLUME_MOUNT the fastio path of IRP_MJ_FILE_SYSTEM_CONTROL.IRP_MN_MOUNT_VOLUME?

In my minifilter driver, I can see only IRP_MJ_VOLUME_MOUNT.

Thanks in advance!

Alex.

2

IRP_MJ_VOLUME_MOUNT is the equivalent of IRP_MJ_FILE_SYSTEM_CONTROL.IRP_MN_MOUNT_VOLUME in the minifilter model. For some IRP_MJ_FILE_SYSTEM_CONTROL.IRP_MN_MOUNT_VOLUME notifications filter manager might not attach to the volume and so you don’t see the IRP_MJ_VOLUME_MOUNT. It looks like a FAST_IO as far as minifilters are concerned.

Regards,
Alex.
This posting is provided “AS IS” with no warranties, and confers no rights.