Detecting file size changes in cache

Hi,

in my filter dirver I’m trying to keep track of the size for a file, which
normally works fine. I’ve however noticed that if a query the file size
using FsRtlGetFileSize() when a IRP_MJ_FLUSH_BUFFERS has been completed,
then the size reported is not the same as the one I’ve calculated. This
leads me to belive that this is related to something that occurrs in the
cache without my filter driver being called. Is there any way to trace these
size changes BEFORE they happend?

/Svante

> cache without my filter driver being called. Is there any way to trace
these

size changes BEFORE they happend?

Acquire the CommonFCBHeader->MainResource and then
CommonFCBHeader->PagingIoResource shared and then touch the size fields in
CommonFCBHeader. Then release the locks.
NOTE! This can be done only if IoGetTopLevelIrp() == NULL, which means - FCB
locks are not taken by this thread.

Max