Hello everyone, I was wondering if someone can help me with this technical matter.
I am currently involved in a project writing a disk class upper filter driver. The purpose of this is to intercept all writes to the hard drive and store them somewhere else instead.
(The filter is installed in the device stack between disk and partmgr.)
All writes that come in through IRP_MJ_WRITE are intercepted and written to some other media, and all subsequent reads that come in through IRP_MJ_READ to those sectors is read from this other media instead of from the real sectors on the hard drive.
We’re running our driver in a test mode during development. In this mode, writes are intercepted and kept in nonpaged memory (limited amount, but this is only for testing), but at the same time the same IRP is sent down the driver stack and the write is performed to the real hard drive sectors as well. And, when a read is later issued to the same sectors, the data is read from the real hard drive sectors first, and compared to the data that has been saved in memory earlier.
The problem is, we’re getting data mismatches during this stage. The mismatches occur generally on registry files (stuff under %systemdir%\config) and on part of the master file table (mft). These mismatches only seem to occur on the system volume.
I’ve read through the documentation extensively, but I cannot think of what can be causing this. Is data written to the hard drive in ways other than IRP_MJ_WRITE? Is that how I’m missing these?
Can someone help me?