Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging

The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.

Check out The OSR Learning Library at:


Jorgen_LundmanJorgen_Lundman Member - All Emails Posts: 47

Real basic question here, my apologies. So when I get IRP_MJ_CREATE with NULL name, and NULL relativeObject, it is known as a "volume open".

I used to simply grab the root "\" object, and return that. But this is causing some issues, in that I now have two Fileobjects with FsContext pointing to one vnode of "\". (Open of literal "\" and volume open).

So, what IS a volume open anyway? What operations is generally performed on a volume handle? Are read/writes done, and if so, what data is expected? Is it perhaps like opening the raw disk? (then, why not just open the disk, instead of via the filesystem)


  • Scott_Noone_(OSR)Scott_Noone_(OSR) Administrator Posts: 3,260

    A volume is a logical grouping of one or more partitions. So, opening the disk is not equivalent.

    Yes, you can read and write the volume (e.g. this is how format works). Normally you see queries for volume level information (free space, etc) but there are a bunch other requests that require a volume handle (defrag comes to mind). The FASTFAT source should give you a good baseline of what the file system is supposed to do with a volume open. Note that there are some special semantics around what it means to open a volume with no share. Again see FASTFAT.


  • Jorgen_LundmanJorgen_Lundman Member - All Emails Posts: 47

    "A volume is a logical grouping of one or more partitions." that sounds almost like opening the raw device on Unix, as opposed to a slice/partition.

    Following the thread of Volume Open in FASTFAT sources was not easy, but I will attempt it again. I guess I need to decide what to do with Volume Opens in ZFS, since there isn't (always) a single physical device under the mount (mirror/raids) but it does sound that, besides the disk-size requests and similar things, I can just return zero data on READ requests, and "make up" correctish looking partitions for the dataset that is open. I don't anticipate working with defrag or format.

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 30 Mar 2020 OSR Seminar Space
Developing Minifilters 15 Jun 2020 LIVE ONLINE
Writing WDF Drivers 22 June 2020 LIVE ONLINE
Internals & Software Drivers 28 Sept 2020 Dulles, VA