about write sequence in Vista

NTFSD
1

Hi!

I have a question about write sequence in Windows Vista.
It seems that one of write sequence has changed in Windows Vista.

In Windows XP, IRP_MJ_WRITE is issued with actual write size.
In Windows Vista, however, IRP_MJ_WRITE is issued with the multiple of 4KB size.
And then IRP_MJ_SET_INFO & EOF request is issued with actual write size.
The exceeded data is cut off and become the actual file size.

Is there any way to get the actual file size when IRP_MJ_WRITE is issued in Windows Vista?

2

This has been so in XP, and if memory serves right, is the way it happens in NT4 even.

xxxxx@sciencepark.co.jp wrote:

Hi!

I have a question about write sequence in Windows Vista.
It seems that one of write sequence has changed in Windows Vista.

In Windows XP, IRP_MJ_WRITE is issued with actual write size.
In Windows Vista, however, IRP_MJ_WRITE is issued with the multiple of 4KB size.
And then IRP_MJ_SET_INFO & EOF request is issued with actual write size.
The exceeded data is cut off and become the actual file size.

Is there any way to get the actual file size when IRP_MJ_WRITE is issued in Windows Vista?

Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

–
Kind regards, Dejan
http://www.alfasp.com
File system audit, security and encryption kits.

3

Dejan,

Thanks for your reply.

I have never experienced such I/O in XP.
In Vista, all write sequence is proccessed the way I wrote above.

Does anyone know if write sequence has changed dramatically in Vista?