I write a disk filter driver using diskperf as prototype. Recently I found a curious problem. In my computer, there is gap(or hidden sectors) between partitions, When I format(or fast format) a partition in Windows Disk Manager, the Partition Type(NTFS=0x07 FAT32=0x0B) is written to the gap, the problem is my filter can’t filter the write to the gap, neither can DiskMon, but If I use WinHex to edit the gap, both my filter and DiskMon can get the write. Is there some secret write by Windows Disk Manager? By the way, I’ve refused all the IOCTL_DISK_SET… IOCTL_DISK_FORMAT… stuff.
Formatting hard drives is done by using standard data writes, not through
the IOCTL_DISK_FORMAT related ioctls. Those are generally for floppy disks
only. That said, the mechanism for formatting hard disks is file system
specific and uses undocumented filesystem specific user mode dlls to perform
the format. I seem to recall that Russinovich wrote up some stuff about how
format operations work, I could be wrong.
On Jan 30, 2008 9:43 PM, wrote:
> I write a disk filter driver using diskperf as prototype. Recently I found
> a curious problem. In my computer, there is gap(or hidden sectors) between
> partitions, When I format(or fast format) a partition in Windows Disk
> Manager, the Partition Type(NTFS=0x07 FAT32=0x0B) is written to the gap, the
> problem is my filter can’t filter the write to the gap, neither can DiskMon,
> but If I use WinHex to edit the gap, both my filter and DiskMon can get the
> write. Is there some secret write by Windows Disk Manager? By the way, I’ve
> refused all the IOCTL_DISK_SET… IOCTL_DISK_FORMAT… stuff.
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@hollistech.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
–
Mark Roddy