File system filter

NTFSD
1

Hello developers,
I have questions about file system filter driver.
If I’m using file system filter driver, can I obtain the VCB of volume or FCB of file.
Can I purge a volume cache if there are some opened files on this volume?

Best:
Aleko

2

>If I’m using file system filter driver, can I obtain the VCB of volume or
FCB of

file.

The part of FCB with the layout of FSRTL_COMMON_FCB_HEADER is
pointed to by FileObject->FsContext.
But it is not known where the real FCB begins -
FSRTL_COMMON_FCB_HEADER can be at any offset inside the FCB.
As about the VCB - it is the private FSD’s data structure pointed to by the
FCB. IO manager imposes no limitations on it.

Max