How to mount a volume with NTFS

NTFSD
1

Hi everyone,

I created a disk deviceObject and created a symbolic link for it in a Minifilter driver.
How can I mount it with NTFS? What kind of kernel routines should I use?
Actually, when querying its properties, I want it show the same properties as C:(Type, FileSystem, Used space, etc). Or should I create a “FILE_DEVICE_VIRTUAL_DISK”.

Thanks for any reply.

status = IoCreateDevice( DriverObject,
0,
&cdoName, // “\Device\1234567890”
FILE_DEVICE_DISK,
FILE_DEVICE_SECURE_OPEN,
FALSE,
&gGlobalData.cdo);
if (!NT_SUCCESS(status)) {
return status;
}

status = IoCreateSymbolicLink(&cdoSblNm, &cdoName);// L"\??\Z:"

if (!NT_SUCCESS(status)) {
IoDeleteDevice(gGlobalData.cdo);
return status;
}

2

I have an impression that you believe the kernel formats a volume.

You need to format a media with NTFS and then call NtCreateFile or IoVerifyVolume to mount FSD. The system will initiate file system object mounting. You can call CreateFile from a user mode application as well. You can open a volume or any path on it. If you chose to open a volume then request more than just read attributes rights or the system doesn’t initiate the mount. Opening a root directory as L"\.\Z:"is a reasonable option.

DriverObject in your example must be for a driver that supports volume or disk interface.

How you are going to format a volume is up to you. For example the standard command line routine does the job https://technet.microsoft.com/en-us/library/cc730730(v=ws.11).aspx or you can make a carbon copy of a formatted volume.

3

Thanks Slava for your reply.

I actually want to realize shadow files for encryption in order to solve the memory mapping files problems.

Some one suggested that virtual disk was another solution. Maybe I can realize shadow files without the virtual disk.

Thanks.