How to get current volume name in Filesystem driver?

NTDEV
1

Hi guys,

I wrote a FileSystem Driver for prevent USB Mass Storage. i need to get full information about attached device and then block this.
in this dispatch IRP_MJ_FILE_SYSTEM_CONTROL i handle IRP_MN_MOUNT_VOLUME with two purpose, first obtain little information with IOCTL_STORAGE_QUERY_PROPERTY and second block devices.
and also for achive more information about USB i add IoRegisterPlugPlayNotification to get USB VID and PID at GUID_DEVICE_INTERFACE_ARRIVAL Event.

My problem is once occured usb arrival event and IRP_MN_MOUNT_VOLUME occured any times to accessed device with BusTypeUsb.
Now for solve this my idea is create black and white List with recognize device volume name(e.g. C:\ allow and usb with VID and PID with drive name h:\ is usb blocked ) in PlugPlayNotification CallBack and IRP_MJ_FILE_SYSTEM_CONTROL dispatcher.

Please help me to solve this.

Thank you.

2

I believe you are looking for IoVolumeDeviceToDosName . I am not sure that you will always be able to successfully retrieve a DOS volume name while processing a mount operation as it doesn’t require to have a volume letter to open a file on a volume.

Also, I didn’t get the idea with blocking but volume letters/names are not fixed and can be reused. Volume letters/names are also user session specific and the same drive can have different letters in different sessions. The systems maintains a database( as registry entries, if I remember correctly ) to assign the same letter to a volume across multiple plug-unplug events but this database doesn’t guarantee that the same letter will be used for the same device as one letter might be assigned to multiple devices so in case of a conflict a new letter is assigned.