Detecting disk formatting in filter

NTFSD
1

How does a file filter driver gets notified if user is about to format
the disk?

Thanks,
NKK

2

Check IRP_MJ_DEVICE_CONTROL and parameter should be IOCTL_DISK_FORMAT_TRACKS or IOCTL_DISK_FORMAT_TRACKS

Petr

----- Original Message -----
From: “Kohli, Naveen”
To: “Windows File Systems Devs Interest List”
Sent: Friday, March 19, 2004 3:33 PM
Subject: [ntfsd] Detecting disk formatting in filter

> How does a file filter driver gets notified if user is about to format
> the disk?
>
> Thanks,
> NKK
>
>
> —
> Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@asw.cz
> To unsubscribe send a blank email to xxxxx@lists.osr.com

3

By FSCTL_LOCK_VOLUME IOCTL only.

The sequence is:

  • FSCTL_LOCK_VOLUME
  • format
  • FSCTL_DISMOUNT_VOLUME
  • FSCTL_UNLOCK_VOLUME
  • close the handle
  • the next CreateFile will mount the new, freshly formatted volume

CHKDSK /F does the same.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Kohli, Naveen”
To: “Windows File Systems Devs Interest List”
Sent: Friday, March 19, 2004 5:33 PM
Subject: [ntfsd] Detecting disk formatting in filter

> How does a file filter driver gets notified if user is about to format
> the disk?
>
> Thanks,
> NKK
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

4

Are they sent for floppies only or for harddisks too?

I saw the formatting path for harddisk partitions and USB flashes in the
debugger. Full (non quick) format sends VERIFY IOCTLs for the whole disk
surface, then writes the new empty filesystem medatada.

Quick format even does no VERIFY, it only writes the new metadata and does
no more writes.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Petr Kurtin”
To: “Windows File Systems Devs Interest List”
Sent: Friday, March 19, 2004 5:50 PM
Subject: Re: [ntfsd] Detecting disk formatting in filter

> Check IRP_MJ_DEVICE_CONTROL and parameter should be IOCTL_DISK_FORMAT_TRACKS
or IOCTL_DISK_FORMAT_TRACKS
>
> Petr
>
>
> ----- Original Message -----
> From: “Kohli, Naveen”
> To: “Windows File Systems Devs Interest List”
> Sent: Friday, March 19, 2004 3:33 PM
> Subject: [ntfsd] Detecting disk formatting in filter
>
>
> > How does a file filter driver gets notified if user is about to format
> > the disk?
> >
> > Thanks,
> > NKK
> >
> >
> > —
> > Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
> >
> > You are currently subscribed to ntfsd as: xxxxx@asw.cz
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

5

Thanks!
I will give this a try.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S.
Shatskih
Sent: Friday, March 19, 2004 10:08 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] Detecting disk formatting in filter

By FSCTL_LOCK_VOLUME IOCTL only.

The sequence is:

  • FSCTL_LOCK_VOLUME
  • format
  • FSCTL_DISMOUNT_VOLUME
  • FSCTL_UNLOCK_VOLUME
  • close the handle
  • the next CreateFile will mount the new, freshly formatted volume

CHKDSK /F does the same.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Kohli, Naveen”
To: “Windows File Systems Devs Interest List”
Sent: Friday, March 19, 2004 5:33 PM
Subject: [ntfsd] Detecting disk formatting in filter

> How does a file filter driver gets notified if user is about to format
> the disk?
>
> Thanks,
> NKK
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@criticalsites.com
To unsubscribe send a blank email to xxxxx@lists.osr.com