Cache Problem in file system filter driver

NTFSD
1

Hi all!

I am developing a file system Filter driver.
When I create a new file and save it, IRP_MJ_WRITE is sent. But when I close
it
and try to open the same file from Windows Explorer I do not get any
IRP_MJ_READ but
the notepad shows the file data (when I run “type” command, the IRP_MJ_READ
is sent). The file
seems to be cached, but only FastIoQueryOpen, FastIoQueryBasicInfo and
SaharaFastIoQueryStandardInfo
are called for volume filter device object.
Where the file data is read from?
Should I handle FastIo operations for file system filter device object?
I have to handle at least the first file read operation. How can I solve
this problem?

Thanks,
Dani

2

Please look up notepad in the archives, this has been discussed sooooooo
many times!

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply

“Dani Polovets” wrote in message
news:xxxxx@ntfsd…
> Hi all!
>
> I am developing a file system Filter driver.
> When I create a new file and save it, IRP_MJ_WRITE is sent. But when I
> close
> it
> and try to open the same file from Windows Explorer I do not get any
> IRP_MJ_READ but
> the notepad shows the file data (when I run “type” command, the
> IRP_MJ_READ
> is sent). The file
> seems to be cached, but only FastIoQueryOpen, FastIoQueryBasicInfo and
> SaharaFastIoQueryStandardInfo
> are called for volume filter device object.
> Where the file data is read from?
> Should I handle FastIo operations for file system filter device object?
> I have to handle at least the first file read operation. How can I solve
> this problem?
>
> Thanks,
> Dani
>
>
>
>

3

I don’t think this is the notepad issue, I saw the same behavior
with Visual Studio, for example.
I saw some similar questions in the archive and the answer was to
handle FastIo. But I got nothing for volume filter device object.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Don Burn
Sent: ? 25 ??? 2006 18:20
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] Cache Problem in file system filter driver

Please look up notepad in the archives, this has been discussed sooooooo
many times!

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply

Hi all!

I am developing a file system Filter driver.
When I create a new file and save it, IRP_MJ_WRITE is sent. But when I
close
it
and try to open the same file from Windows Explorer I do not get any
IRP_MJ_READ but
the notepad shows the file data (when I run “type” command, the
IRP_MJ_READ
is sent). The file
seems to be cached, but only FastIoQueryOpen, FastIoQueryBasicInfo and
SaharaFastIoQueryStandardInfo
are called for volume filter device object.
Where the file data is read from?
Should I handle FastIo operations for file system filter device object?
I have to handle at least the first file read operation. How can I solve
this problem?

Thanks,
Dani

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@safend.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

> IRP_MJ_READ but

the notepad shows the file data (when I run “type” command, the
IRP_MJ_READ

NOTEPAD is known to use memory-mapped files.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com