Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

IRP_MJ_WRITE and Last Modified Time

Adam_MarcionekAdam_Marcionek Member Posts: 21
What is the responsibility of an FSD with respect to setting the last modified time on an IRP_MJ_WRITE. I was looking at the differences between an Explorer 'cut and paste' between one NTFS volume to another and one NTFS volume to our FSD. In the former case, the last modified time is preserved but in the latter it is not. Our FSD updates last modified way down in the stack (within our user mode service) for every write call. So what I can see from a ProcMon trace is that Explorer is issuing the WriteFile and then back dating the last modified through a SetBasicInformationFile, but a bit after that, I can see a WriteFile from the System process presumably from the cache manager lazy writer? And its that last operation that updates the date in our FSD due to the higher level code. So am I not supposed to set the last modified if it comes from the cache manager and if so how do I know?


  • Scott_Noone_(OSR)Scott_Noone_(OSR) Administrator Posts: 3,021
    The paging I/O should not update the modified time. See FAT:

    // If this was not PagingIo, mark that the modify
    // time on the dirent needs to be updated on close.

    if ( !PagingIo ) {

    SetFlag( FileObject->Flags, FO_FILE_MODIFIED );



  • rod_widdowsonrod_widdowson Member - All Emails Posts: 971
    In addition to Scott's point, you also need to update (some of) the times at
    cleanup only. Further if you support hard link the semantics are very
    particular (the date on the modified file status as it was until such time
    as it is opened (not closed) by that path.

    The IFSTESTS are very very keen on exactly correct behavior and recent
    versions even come with decent explanations of what you are doing wrong.

    TLDR: you need to simulate DIRENTS even if you don't gave them
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!