Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
Upcoming OSR Seminars | ||
---|---|---|
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead! | ||
Kernel Debugging | 13-17 May 2024 | Live, Online |
Developing Minifilters | 1-5 Apr 2024 | Live, Online |
Internals & Software Drivers | 11-15 Mar 2024 | Live, Online |
Writing WDF Drivers | 26 Feb - 1 Mar 2024 | Live, Online |
Comments
command:
C:\WINDOWS\system32>fsutil file queryextents c:\$mft
VCN: 0x0 Clusters: 0xc820 LCN: 0xc0000
VCN: 0xc820 Clusters: 0xc817 LCN: 0xd1e409
VCN: 0x19037 Clusters: 0xc80a LCN: 0x2adc376
VCN: 0x25841 Clusters: 0xcb2f LCN: 0x3368eb2
VCN: 0x32370 Clusters: 0xb092 LCN: 0x7b4b496
VCN: 0x3d402 Clusters: 0x69be LCN: 0x5d5db20
However, I'm not sure about your approach. You certainly are going to have
problems sending this in the paging I/O path. Even in the user path, writes
can extend so the target VCN might not have an LCN allocated for it yet.
If you need to track volume writes then you should be at the volume level.
In the past we have correlated the volume I/O to file I/O with an assist
from a file system filter.
-scott
OSR
@OSRDrivers
-scott
OSR
fsutil looks fine.. could it use some another FSCTL for queryextents command?
Since my task is about to migrate from volume level to file filter level, maybe I should just find out the moment when VCN have LCN allocated for sure? For instance, in PostWrite callback or via some postponed workitem?
VCN: 0x0 Clusters: 0xc820 LCN: 0xc0000
VCN: 0xc820 Clusters: 0xc807 LCN: 0xa2e239
VCN: 0x19027 Clusters: 0xa3d9 LCN: 0x34cde3
C:\WINDOWS\system32>fsutil file queryextents c:\$bitmap
Error: Access is denied.
C:\WINDOWS\system32>fsutil file queryextents c:\$logfile
Error: Access is denied.
Seems like fsutil (run as Administrator) works not for all metadata files.
fsutil looks fine.. could it use some another FSCTL for queryextents
command?
</QUOTE>
ProcMon will pretty much tell you how fsutil works.
<QUOTE>
Since my task is about to migrate from volume level to file filter level,
maybe I should just find out the moment when VCN have LCN allocated for
sure? For instance, in PostWrite callback or via some postponed workitem?
</QUOTE>
It's internal to the file system. I'm not sure that you could ever always
accurately track the blocks of the file unless you open it exclusive, mark
the file as immovable (FSCTL_MARK_HANDLE/MARK_HANDLE_PROTECT_CLUSTERS), and
then query.
-scott
OSR
@OSRDrivers
-scott
OSR