Can FS filter block drag & drop operation?

NTFSD
1

Hi All,
I’m working on document protection and trying to block user highlight
part of content, drag & drop to other places(desktop or application).
Can FS filter driver block this content stealing or not? If yes, what
IRP should I monitor? From Filemon, I didn’t find special IRP during
drag & drop operation.

Thanks

2

This is nothing more than a copy or rename operation at the file system
level. How you figure out that the user is doing drag-and-drop would be
heuristic based - perhaps you could use some sort of shell extension?

Regards,

Tony

Tony Mason

Consulting Partner

OSR Open Systems Resources, Inc.

http://www.osr.com http:</http:>

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of David Wu
Sent: Thursday, October 14, 2004 9:32 PM
To: ntfsd redirect
Subject: [ntfsd] Can FS filter block drag & drop operation?

Hi All,

I’m working on document protection and trying to block user highlight

part of content, drag & drop to other places(desktop or application).

Can FS filter driver block this content stealing or not? If yes, what

IRP should I monitor? From Filemon, I didn’t find special IRP during

drag & drop operation.

Thanks

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Hi Tony,
Thank you for advising.
I trace the activities of process that open the document. But I can
barely find very useful
IRP for this process. For example, opening a xls file, selecting several
columns, holding
the edge of selected columns, dragging selected columns and dropping to
desktop,
the file with file name “Worksheet Scrap xxxxxx” will be created. The
selected content will be saved
in this file. I can see explore do most of jobs during this drag & drop
operation. But for
Excel, I can’t find some special IRP during this operation. Is this
still
some kind of copy?

Thanks

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Tony Mason
Sent: Thursday, October 14, 2004 8:49 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Can FS filter block drag & drop operation?

This is nothing more than a copy or rename operation at the file system
level. How you figure out that the user is doing drag-and-drop would be
heuristic based - perhaps you could use some sort of shell extension?

Regards,

Tony

Tony Mason

Consulting Partner

OSR Open Systems Resources, Inc.

http://www.osr.com http:</http:>

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of David Wu
Sent: Thursday, October 14, 2004 9:32 PM
To: ntfsd redirect
Subject: [ntfsd] Can FS filter block drag & drop operation?

Hi All,

I’m working on document protection and trying to block user highlight

part of content, drag & drop to other places(desktop or application).

Can FS filter driver block this content stealing or not? If yes, what

IRP should I monitor? From Filemon, I didn’t find special IRP during

drag & drop operation.

Thanks

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

Message> I trace the activities of process that open the document. But I can barely find very useful

IRP for this process. For example, opening a xls file, selecting several columns, holding
the edge of selected columns, dragging selected columns and dropping to desktop,
the file with file name “Worksheet Scrap xxxxxx” will be created. The selected content will be saved

The layer of filter drivers knows nothing about
the drag&drop operations. Thus, no special “Drag&drop” IRP
comes. From the point of view of filter driver,
dragging a part of datasheet to desktop
means creating a file in the folder where desktop is
(This alone is difficult to find in the filter driver), writing the selected
datasheet part and closing the file. If you want to prevent
EXCEL from doing this, you must prevent creating
the file on the desktop.

I only would like to note that preventing user-mode apps
from saving files is a road to hell, because they normally
create a lot of files (temporary files, user templates etc.),
it is very VERY difficult to recognize which creates
could be allowed and which operation should be denied.

And also, particularly for MS Office, I am not sure if is is possible
to prevent them from sending the complete document by mail
(using “File - Send to - Mail recipient”), which goes completely
without assistance of file system driver (at least in the case if
Outlook is installed)

It is also very difficult to prevent applications to transfer data
through the clipboard (You can easily steal data from MS Word
by copying them to Wordpad in RTF format).

So, my personal advice about this is - give it up.
You are trying to achieve nearly impossible thing.

L.

5

Message Impossible. Your filter will have no idea of whether the data in the current Excel document was obtained "legitimately" or not so.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com

----- Original Message -----
From: David Wu
To: Windows File Systems Devs Interest List
Sent: Friday, October 15, 2004 6:48 AM
Subject: RE: [ntfsd] Can FS filter block drag & drop operation?

Hi Tony,
Thank you for advising.
I trace the activities of process that open the document. But I can barely find very useful
IRP for this process. For example, opening a xls file, selecting several columns, holding
the edge of selected columns, dragging selected columns and dropping to desktop,
the file with file name "Worksheet Scrap xxxxxx" will be created. The selected content will be saved
in this file. I can see explore do most of jobs during this drag & drop operation. But for
Excel, I can't find some special IRP during this operation. Is this still
some kind of copy?

Thanks
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Tony Mason
Sent: Thursday, October 14, 2004 8:49 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Can FS filter block drag & drop operation?

This is nothing more than a copy or rename operation at the file system level. How you figure out that the user is doing drag-and-drop would be heuristic based - perhaps you could use some sort of shell extension?

Regards,

Tony

Tony Mason

Consulting Partner

OSR Open Systems Resources, Inc.

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of David Wu
Sent: Thursday, October 14, 2004 9:32 PM
To: ntfsd redirect
Subject: [ntfsd] Can FS filter block drag & drop operation?

Hi All,

I'm working on document protection and trying to block user highlight

part of content, drag & drop to other places(desktop or application).

Can FS filter driver block this content stealing or not? If yes, what

IRP should I monitor? From Filemon, I didn't find special IRP during

drag & drop operation.

Thanks

Questions? First check the IFS FAQ at The NT Insider:Windows NT Virtual Memory (Part I)

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ''
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at The NT Insider:Windows NT Virtual Memory (Part I)

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ''
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at The NT Insider:Windows NT Virtual Memory (Part I)

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ''
To unsubscribe send a blank email to xxxxx@lists.osr.com