Recognize UserDataFile from file system filter driver

NTFSD
1

How can I recognize User Data files in Create completion routine.
I manage the volume open request. But I cannot make absolute difference
between directory and files.
Thanks
Jack

Get Your Private, Free Email at http://www.hotmail.com

2

Does the creation of a system file goes throgh the IRP_MJ_CREATe of file
system filter. If it does how can I recognize an user file from an system
one.

Thanks a lot of

Get Your Private, Free Email at http://www.hotmail.com

3

You must call down to the FSD with an
IRP_MJ_QUERY_INFORMATION:StandardInformation.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Jack Brown
Sent: Tuesday, March 14, 2000 1:43 AM
To: File Systems Developers
Subject: [ntfsd] Recognize UserDataFile from file system filter driver

How can I recognize User Data files in Create completion routine.
I manage the volume open request. But I cannot make absolute difference
between directory and files.
Thanks
Jack

Get Your Private, Free Email at http://www.hotmail.com

You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

4

Thanks Jamey,
but do you mean
IoQueryFileInformation(IrpSp->FileObject,
FileStandardInformation,
sizeof(FILE_STANDARD_INFORMATION),
(PFILE_STANDARD_INFORMATION)OutputBiffer,
sizeof(FILE_STANDARD_INFORMATION));
or you mean
irp = IoBuildSynchronousFsdRequest(IRP_MJ_QUERY_INFORMATION,
DeviceObject,
(PFILE_STANDARD_INFORMATION)Biffer,
sizeof(FILE_STANDARD_INFORMATION),
0,
&event,
&IoBlock);
irpSp = IoGetNextIrpStackLocation(irp);
irpSp->Parameters.QueryFile.Length=sizeof(FILE_STANDARD_INFORMATION);
irpSp->Parameters.QueryFile.FileInformationClass = FileStandardInformation;
irpSp->FileObject = IrpCreateStack->FileObject;

If it is the second one I am afraid that I can have the same problem as
yours one with the Page Fault.
I am sorry but I couldn’t get exactly your solution.
Thank you again for the attention!
Jack

From: “Jamey Kirby”
>Reply-To: “File Systems Developers”
>To: “File Systems Developers”
>Subject: [ntfsd] RE: Recognize UserDataFile from file system filter driver
>Date: Tue, 14 Mar 2000 08:28:22 -0800
>
>You must call down to the FSD with an
>IRP_MJ_QUERY_INFORMATION:StandardInformation.
>
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com]On Behalf Of Jack Brown
> > Sent: Tuesday, March 14, 2000 1:43 AM
> > To: File Systems Developers
> > Subject: [ntfsd] Recognize UserDataFile from file system filter driver
> >
> >
> > How can I recognize User Data files in Create completion routine.
> > I manage the volume open request. But I cannot make absolute difference
> > between directory and files.
> > Thanks
> > Jack
> >
> > Get Your Private, Free Email at http://www.hotmail.com
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> > To unsubscribe send a blank email to $subst(‘Email.Unsub’)
> >
> >
>
>
>—
>You are currently subscribed to ntfsd as: xxxxx@hotmail.com
>To unsubscribe send a blank email to $subst(‘Email.Unsub’)
>


Get Your Private, Free Email at http://www.hotmail.com

5

> Does the creation of a system file goes throgh the IRP_MJ_CREATe of file

system filter. If it does how can I recognize an user file from an system
one.

What do you mean under the term “system file”?
A file with FILE_ATTRIBUTE_SYSTEM? Then - yes.
A file like NTFS’s MFT?. Then no - they are created at format time - AFAIK
by user-mode code writing the prepared data structures directly to disk
sectors.

Max

6

I mean exactly NTFS’s MFT. Can I obtain somehow its file object?

From: “Maxim S. Shatskih”
>Reply-To: “File Systems Developers”
>To: “File Systems Developers”
>Subject: [ntfsd] Re: Recognize UserDataFile from file system filter driver
>Date: Wed, 15 Mar 2000 05:51:34 +0300
>
> > Does the creation of a system file goes throgh the IRP_MJ_CREATe of file
> > system filter. If it does how can I recognize an user file from an
>system
> > one.
>
>What do you mean under the term “system file”?
>A file with FILE_ATTRIBUTE_SYSTEM? Then - yes.
>A file like NTFS’s MFT?. Then no - they are created at format time - AFAIK
>by user-mode code writing the prepared data structures directly to disk
>sectors.
>
> Max
>
>
>—
>You are currently subscribed to ntfsd as: xxxxx@hotmail.com
>To unsubscribe send a blank email to $subst(‘Email.Unsub’)
>

______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com

7

Open $Mft. ôhis is possible.

----- Original Message -----
From: Jack Brown
To: File Systems Developers
Sent: Wednesday, March 15, 2000 9:59 AM
Subject: [ntfsd] Re: Recognize UserDataFile from file system filter driver

> I mean exactly NTFS’s MFT. Can I obtain somehow its file object?

8

Hello!
Yes I tryied it with

RtlInitUnicodeString( &nameString, L"\??\D:\$MFT" );
status = IoGetDeviceObjectPointer(&nameString, FILE_READ_ATTRIBUTES,
&MftFileObject, &MftDevice);

It invokes IRP_MJ_CREATE with file object $MFT but the IRP is completed with
status ACCESS DENIED. I am not sure if ZwCreateFile works - I think I tried
it a month ago and the result was the same.
If I start from the command prompt the command dir $mft /ah it sends
FASTIO_QUERY_OPEN ($Mft) and it completes with status SUCCESS.
The problem is that as I understood I cannot set a completion routine of
Fast I/O. (I need the file object after the file is already opened).
Thanks!
Jack

From: “Maxim S. Shatskih”
>Reply-To: “File Systems Developers”
>To: “File Systems Developers”
>Subject: [ntfsd] Re: Recognize UserDataFile from file system filter driver
>Date: Thu, 16 Mar 2000 05:20:09 +0300
>
>Open $Mft. ôhis is possible.
>
>----- Original Message -----
>From: Jack Brown
>To: File Systems Developers
>Sent: Wednesday, March 15, 2000 9:59 AM
>Subject: [ntfsd] Re: Recognize UserDataFile from file system filter driver
>
>
> > I mean exactly NTFS’s MFT. Can I obtain somehow its file object?
>
>
>
>—
>You are currently subscribed to ntfsd as: xxxxx@hotmail.com
>To unsubscribe send a blank email to $subst(‘Email.Unsub’)
>

______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com