Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Tracking File/Directory Creates for an Auditing Minifilter

shanthikpshanthikp Member Posts: 7
edited April 2019 in NTFSD

I am trying to develop an auditing minifilter that captures all file/dir/share create/delete/rename/read/writes occurring on a volume. I followed the minispy code that MSFT released and made the following modifications to identify file/dir creates. I replaced the handler for IRP_MJ_CREATE with the following handler




In user-space I check the IOStatus.information == FILE_CREATED to verify that the file was actually created and not just opened or overwritten. It seems to work from the shell and windows explorer but I am not sure if this code catches all possible ways in which files can be created. Feedback is welcome..

Comments

  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,120

    Your code says that you are interested in deletes. I assume that is work in progress (you'll need much more for that).

    As for your question three things (at least) spring to mind, depending on whether you care about files or about directory entries:

    • Rename creates and deletes directory entries
    • Hard link creation creates directory entries
    • Sort of as an extreme, aborting a transaction which deleted (or renamed) a file can (kinda-sorta) cause the file to be created.

    There is almost certainly more.

  • shanthikpshanthikp Member Posts: 7

    yes delete/rename is WIP. what IRP does hard link creation generate ??

  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,120

    what IRP does hard link creation generate

    IRP_MJ_SET_INFORMATION / FileLinkInformation

    Hard link creation is like rename, but without the DIRENT deletion

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 30 Mar 2020 OSR Seminar Space
Developing Minifilters 15 Jun 2020 LIVE ONLINE
Writing WDF Drivers 22 June 2020 LIVE ONLINE
Internals & Software Drivers 28 Sept 2020 Dulles, VA