file object used in paging write is for a deleted name

I’m filtering writes and need to record what name a write is made with. In my test case, a new stream is created then a couple of hard links are created. A delete is performed using the first name. A write is made using the second hard link. The problem is that if the write is cached, the file object passed to the pre and post-write callbacks is for the first name. I need to reflect the actual name used for the write but I’m not sure how to get the “correct” file object. Non-cached writes aren’t a problem.

I know how the cache manager initiates caching so I’m looking for a way to get around the annoying behavior of receiving the original file object and get the one used in the write so I can resolve the correct name. In my application, the name is imperative for proper operation and verification.

I’m aware that this isn’t the answer you need, but by the time that paging happens the name is completely irrelevant, therefore there can be no “proper operation or verification”. You can open one link for read and one for write and the paging writes can happen to the read file object.

If you really care you should be worrying about the cached and non buffered IO and section creation.

In my application, the name is imperative for proper operation and verification

What Dr. Widdowson said.

I’m sorry to tell you that your design is faulty. That’s just not the way Windows works. If there are multiple writers to a cached file… and the data finally gets written to disk by Cc. who is then considered the writer?

You could filter the individual user writes to the cache, but in that case… how will you account for (the commonly used) memory mapped I/O?

Yeah… I’m afraid you’re in a bit of a bind. The best you can do is audit which files are opened for write access, and then note that they’ve been written. But you really can’t know who wrote what to a given file.

Peter