What is the responsibility of an FSD with respect to setting the last modified time on an IRP_MJ_WRITE. I was looking at the differences between an Explorer ‘cut and paste’ between one NTFS volume to another and one NTFS volume to our FSD. In the former case, the last modified time is preserved but in the latter it is not. Our FSD updates last modified way down in the stack (within our user mode service) for every write call. So what I can see from a ProcMon trace is that Explorer is issuing the WriteFile and then back dating the last modified through a SetBasicInformationFile, but a bit after that, I can see a WriteFile from the System process presumably from the cache manager lazy writer? And its that last operation that updates the date in our FSD due to the higher level code. So am I not supposed to set the last modified if it comes from the cache manager and if so how do I know?
The paging I/O should not update the modified time. See FAT:
//
// If this was not PagingIo, mark that the modify
// time on the dirent needs to be updated on close.
//
if ( !PagingIo ) {
SetFlag( FileObject->Flags, FO_FILE_MODIFIED );
}
-scott
OSR
@OSRDrivers
In addition to Scott’s point, you also need to update (some of) the times at
cleanup only. Further if you support hard link the semantics are very
particular (the date on the modified file status as it was until such time
as it is opened (not closed) by that path.
The IFSTESTS are very very keen on exactly correct behavior and recent
versions even come with decent explanations of what you are doing wrong.
TLDR: you need to simulate DIRENTS even if you don’t gave them