Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging

The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.

Check out The OSR Learning Library at:

file object used in paging write is for a deleted name

milosdmilosd Member Posts: 4

I'm filtering writes and need to record what name a write is made with. In my test case, a new stream is created then a couple of hard links are created. A delete is performed using the first name. A write is made using the second hard link. The problem is that if the write is cached, the file object passed to the pre and post-write callbacks is for the first name. I need to reflect the actual name used for the write but I'm not sure how to get the "correct" file object. Non-cached writes aren't a problem.

I know how the cache manager initiates caching so I'm looking for a way to get around the annoying behavior of receiving the original file object and get the one used in the write so I can resolve the correct name. In my application, the name is imperative for proper operation and verification.


  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,131

    I'm aware that this isn't the answer you need, but by the time that paging happens the name is completely irrelevant, therefore there can be no "proper operation or verification". You can open one link for read and one for write and the paging writes can happen to the read file object.

    If you really care you should be worrying about the cached and non buffered IO and section creation.

  • Peter_Viscarola_(OSR)Peter_Viscarola_(OSR) Administrator Posts: 7,851
    edited October 2019

    In my application, the name is imperative for proper operation and verification

    What Dr. Widdowson said.

    I’m sorry to tell you that your design is faulty. That’s just not the way Windows works. If there are multiple writers to a cached file... and the data finally gets written to disk by Cc. who is then considered the writer?

    You could filter the individual user writes to the cache, but in that case... how will you account for (the commonly used) memory mapped I/O?

    Yeah... I’m afraid you’re in a bit of a bind. The best you can do is audit which files are opened for write access, and then note that they’ve been written. But you really can’t know who wrote what to a given file.


    Peter Viscarola

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 30 Mar 2020 OSR Seminar Space
Developing Minifilters 15 Jun 2020 LIVE ONLINE
Writing WDF Drivers 22 June 2020 LIVE ONLINE
Internals & Software Drivers 28 Sept 2020 Dulles, VA