I have a file filter driver and I want to ignore alternate data stream opens. Is there a definitive way to know an opening file is an alternate data stream? What I currently have is if the FileObject->RelatedFileObject is not null and FileObject->FileName.Buffer[0] == L’:’ I assume it’s an ADS, but this doesn’t seem to be comprehensive.
-Mike
If your filter is not a legacy filter, why not just use the
FltGetDestinationFileName() API, which returns the file name broken into
components (including stream name, if there is one)? Lots easier than trying
to parse the name yourself.
I have no idea how this might interact with an open by file ID or other
esoteric opens, which will no doubt be a factor.
…dave
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mike Wick
Sent: Tuesday, June 12, 2007 9:57 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Detecting alternate data streams
I have a file filter driver and I want to ignore alternate data stream
opens. Is there a definitive way to know an opening file is an alternate
data stream? What I currently have is if the FileObject->RelatedFileObject
is not null and FileObject->FileName.Buffer[0] == L’:’ I assume it’s an ADS,
but this doesn’t seem to be comprehensive.
-Mike
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
This would only capture relative opens. What if you see
\directory\subdirectory:directory_stream_1 - given the algorithm you
described, you’re basically ignoring the stream.
Better would be to look for a ‘:’ in the last component and verify that
the FSD on which you are stacked supports streams (there’s an attribute
bit - don’t test the name, since other file systems besides NTFS support
streams.)
Tony
Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com http:</http:>
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mike Wick
Sent: Tuesday, June 12, 2007 9:57 AM
To: ntfsd redirect
Subject: [ntfsd] Detecting alternate data streams
I have a file filter driver and I want to ignore alternate data stream
opens. Is there a definitive way to know an opening file is an
alternate data stream? What I currently have is if the
FileObject->RelatedFileObject is not null and
FileObject->FileName.Buffer[0] == L’:’ I assume it’s an ADS, but this
doesn’t seem to be comprehensive.
-Mike
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com