Detect NTFS volume

NTFSD
1

My filter driver loads at boot time and uses IoRegisterFsRegistraton
change in order to track all mounts. The problem is that when attaching to
a volume (IRP_MN_MOUNT_VOLUME) I don’t know how to check rather the volume
is NTFS or not. FileMon sample does this using the FileObject, but I don’t
have any file object in IRP_MN_MOUNT_VOLUME.

Does anyone know a way?

Thank you in advance,
Razvan

2

A clever implementation of a filter driver never relay on underlieing file
system. You hardly
can have any reason to know on what FS your attached on.

“Razvan Hobeanu” wrote in message news:xxxxx@ntfsd…
>
> My filter driver loads at boot time and uses IoRegisterFsRegistraton
> change in order to track all mounts. The problem is that when attaching to
> a volume (IRP_MN_MOUNT_VOLUME) I don’t know how to check rather the volume
> is NTFS or not. FileMon sample does this using the FileObject, but I don’t
> have any file object in IRP_MN_MOUNT_VOLUME.
>
> Does anyone know a way?
>
> Thank you in advance,
> Razvan
>
>

3

If only life were that simple. If I had a dollar for every special-case
workaround I have in my filter to accommodate one filesystem or
another’s peculiar behavior, I’d have enough for a three-course meal at
Outback Steakhouse (and those cheesy fries don’t come cheap).

Getting back to his original question… The easy way to do this is call
IoGetBaseFileSystemDeviceObject for every filesytem object you’re
attaching to, then compare pBaseDevice->DriverObject->DriverName to
whatever filesytem you want to match against (NTFS, Fastfat, MRxSmb,
etc).

  • Nicholas Ryan

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Dan Partelly
Sent: Friday, September 20, 2002 6:15 PM
To: File Systems Developers
Subject: [ntfsd] Re: Detect NTFS volume

A clever implementation of a filter driver never relay on
underlieing file system. You hardly can have any reason to
know on what FS your attached on.

“Razvan Hobeanu” wrote in message
news:xxxxx@ntfsd…
>
> My filter driver loads at boot time and uses IoRegisterFsRegistraton
> change in order to track all mounts. The problem is that when
> attaching to a volume (IRP_MN_MOUNT_VOLUME) I don’t know how to check
> rather the volume is NTFS or not. FileMon sample does this using the
> FileObject, but I don’t have any file object in IRP_MN_MOUNT_VOLUME.
>
> Does anyone know a way?
>
> Thank you in advance,
> Razvan
>
>

—
You are currently subscribed to ntfsd as: xxxxx@nryan.com
To unsubscribe send a blank email to %%email.unsub%%

4

In my filter driver I use FileMonGetFullPath to get the full path and IIRC
this routine checks for special case when “NTFS volume and a file object
with no name”. So this is reason.

Thank you,
Razvan

“Razvan Hobeanu” wrote in message news:xxxxx@ntfsd…
>
> My filter driver loads at boot time and uses IoRegisterFsRegistraton
> change in order to track all mounts. The problem is that when attaching to
> a volume (IRP_MN_MOUNT_VOLUME) I don’t know how to check rather the volume
> is NTFS or not. FileMon sample does this using the FileObject, but I don’t
> have any file object in IRP_MN_MOUNT_VOLUME.
>
> Does anyone know a way?
>
> Thank you in advance,
> Razvan
>
>

5

In the mount path, you have an FSD’s control device object.
ObQueryNameString on it and compare the result to \Ntfs.

Max

----- Original Message -----
From: “Razvan Hobeanu”
To: “File Systems Developers”
Sent: Saturday, September 21, 2002 12:49 AM
Subject: [ntfsd] Detect NTFS volume

> My filter driver loads at boot time and uses IoRegisterFsRegistraton
> change in order to track all mounts. The problem is that when
attaching to
> a volume (IRP_MN_MOUNT_VOLUME) I don’t know how to check rather the
volume
> is NTFS or not. FileMon sample does this using the FileObject, but I
don’t
> have any file object in IRP_MN_MOUNT_VOLUME.
>
> Does anyone know a way?
>
> Thank you in advance,
> Razvan
>
> —
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to %%email.unsub%%
>