check if file is opened for the first time

Hello everyone !

The case is - my minifilter attaches to volumes not at boot time (i.e. not on volume mount). So when MJ_CREATE come to my filter i can’t say if this is first create (by checking stream context, which must be attached on first create).

Is there some way to determine first open in such case ?

>The case is - my minifilter attaches to volumes not at boot time (i.e. not

on volume mount). So when MJ_CREATE come >to my filter i can’t say if this
is first create (by checking stream context, which must be attached on
first create).

Why can’t you start at boot time? Or, a more important question, what are
you trying to accomplish?

-scott


Scott Noone
Consulting Associate
OSR Open Systems Resources, Inc.
http://www.osronline.com

“sergey pisarev” wrote in message
news:xxxxx@ntfsd…
> Hello everyone !
>
> The case is - my minifilter attaches to volumes not at boot time (i.e. not
> on volume mount). So when MJ_CREATE come to my filter i can’t say if this
> is first create (by checking stream context, which must be attached on
> first create).
>
> Is there some way to determine first open in such case ?

i need to maintain reference count for some type of files - template can be changed on the fly.
So even if i start at boot time it doesn’t solve my problem entirely.

On May 28, 2010, at 4:32 PM, Scott Noone wrote:

> The case is - my minifilter attaches to volumes not at boot time (i.e. not on volume mount). So when MJ_CREATE come >to my filter i can’t say if this is first create (by checking stream context, which must be attached on first create).

Why can’t you start at boot time? Or, a more important question, what are you trying to accomplish?

-scott


Scott Noone
Consulting Associate
OSR Open Systems Resources, Inc.
http://www.osronline.com

“sergey pisarev” wrote in message news:xxxxx@ntfsd…
>> Hello everyone !
>>
>> The case is - my minifilter attaches to volumes not at boot time (i.e. not on volume mount). So when MJ_CREATE come to my filter i can’t say if this is first create (by checking stream context, which must be attached on first create).
>>
>> Is there some way to determine first open in such case ?
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars
> (including our new fs mini-filter seminar) visit: http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

What about renames ? They can make a file match the template after
IRP_MJ_CREATE… What about setting short names ? Hardlinks ? Do you intend
to keep track of all these ?

Thanks,
Alex.