GUID_IO_VOLUME_NAME_CHANGE too early to call IoVolumeDeviceToDosName (mount in empty NTFS folder)

NTFSD
1

File system mini-filter:

  • Register IoRegisterPlugPlayNotification(EventCategoryTargetDeviceChange, …) from InstanceSetup
  • Call IoVolumeDeviceToDosName(…) when GUID_IO_VOLUME_NAME_CHANGE

Steps:

  • Start driver
  • Mount volume (without any mount points) to empty NTFS directory (c:\dir1)
    Сall IoVolumeDeviceToDosName(…) (from GUID_IO_VOLUME_NAME_CHANGE notification) return GUID name (\?\Volume{}). As if volume does not have a mount point.
  • Remove volume mount point
    IoVolumeDeviceToDosName(…) return previous DOS name (c:\dir1)
  • mount volume (without mount points) to another empty NTFS directory (c:\dir2)
    IoVolumeDeviceToDosName(…) return GUID name again (\?\Volume{})
  • remove volume mount point
    IoVolumeDeviceToDosName(…) return previous DOS name (c:\dir2)
  • <…>

Reproduced on:

  • Windows 10 (build 17134 and 14393)
  • Windows 8.1 (build 9600)
  • Windows 8 (build 9200)

Or is this the expected behavior for mount points?

2

We’ve always just logged the volume GUID and offloaded translating the name into a mount point to user mode. So, sorry, no experience trying to do this to tell you if it should work this way or not. My guess would be that it “works the way it works” and that there’s no real way that it’s supposed to work, but that’s a guess.

3

I suggested that this should work from description for IOCTL_MOUNTMGR_CHANGE_NOTIFY:

A client that only wants to be informed of the changes to a particular volume is advised to register for Plug and Play target device notification and watch for GUID_IO_VOLUME_NAME_CHANGE.