one more additional information.
If a notepad file is created inside the network volume, some data is typed
and saved then the filter driver gets IRP_MJ_WRITE.
But when a file is copied to the network volume, the filter driver does not
get IRP_MJ_WRITE.
Please let me know the way to intercept the write IRP and encrypt the file.
Thanks,
S Ramakrishnan
On Sat, Nov 19, 2016 at 10:20 PM, wrote:
> Hi,
>
> In Windows caching is managed by a file system. When a file system
> receives a “cached write” request it usually calls CcCopyWrite, so data
> goes in cache. Your driver intercepts cache flush requests as non cached
> IO(actually paging IO). But nothing prevents a file system from skipping a
> call to CcCopyWrite and writing directly to a backing store especially when
> a backing store doesn’t have alignment requirements ( as in network FS).
> There are some conditions to be meet for this scenario - e.g. there should
> not be user mapped views for a file.
>
> This doesn’t exclude the possibility that there is a deficiency in your
> implementation and non cached( paging IO ) was sent but was not processed
> by your filter in case of network FS.
>
>
>
>
> —
> NTFSD is sponsored by OSR
>
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer>
></http:>