Instancesetup call

Hi folks

Why if Im opening physicadeviceX fltmgr is calling instance setup? Isnt it supposed to be called when minifilter is going to be attached to fsd stack? When there is open do physical device then this is disk level not fsd isnt it like that?

Thanks a lot

You don’t say how you are opening the physicadeviceX, but assuming that is a
raw disk or partition there is the raw file system attached. Depending on
how you coded things the filter manager will be called.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@gmail.com xxxxx@lists.osr.com
Sent: Saturday, July 08, 2017 2:27 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Instancesetup call

Hi folks

Why if Im opening physicadeviceX fltmgr is calling instance setup? Isnt it
supposed to be called when minifilter is going to be attached to fsd stack?
When there is open do physical device then this is disk level not fsd isnt
it like that?

Thanks a lot


NTFSD is sponsored by OSR

MONTHLY seminars on crash dump analysis, WDF, Windows internals and software
drivers!
Details at http:

To unsubscribe, visit the List Server section of OSR Online at
http:</http:></http:>

Hi,

I’m talking about accessing disk like this:
HANDLE disk = CreateFile(L"\\.\PhysicalDrive0", GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL);

So I’m using symlink to \device\harddisk0\dr0.

  1. Where I can read something about RAW DISK. When it is attached etc?
  2. What you mean when you wrote “Depending on how you coded things the filter manager will be called”? I mean I understand I’m always talking about access to disk, but not really tracking operation of it. Are there any other methods to open drive expect direct open of DO to which I could send IOCTL?

thank you

Windows source code only.
Actually, there is nothing big about RAW. This is a rudimentary file system driver that initializes file objects and pass through IO to the volume or disk class driver.
RAW is mounted when a create request is issued to a disk device object or a volume device object without mounted file system driver. When the last file object is closed the RAW is unmounted.

No, if IOCTL is sent from a user mode application. You need a handle.