detecting file system loaded on the mouted volume

Rohit_Gauba · July 24, 2006, 6:10am

when File Object comes to us at vol mnt time , can we find out which FS
would be loaded corresponding to it, either in the dispatcher routine or in
the completion routine?

Also if we use backup utility from start->Programs->Accessories->system
tools for taking backup

Then a new device with name \Device\HardDiskVolumeShadowCopy1 is mounted.
Can any one explain me what’s the purpose of that

OSR_Community_User · July 24, 2006, 6:27am

ask the archive:
http://www.osronline.com/showThread.cfm?link=15865

m.
----- Original Message -----
From: Rohit
To: Windows File Systems Devs Interest List
Sent: Monday, July 24, 2006 5:09 AM
Subject: [ntfsd] detecting file system loaded on the mouted volume

when File Object comes to us at vol mnt time , can we find out which FS
would be loaded corresponding to it, either in the dispatcher routine or in the completion routine?

Also if we use backup utility from start->Programs->Accessories->system tools for taking backup

Then a new device with name \Device\HardDiskVolumeShadowCopy1 is mounted. Can any one explain me what’s the purpose of that

— Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17 You are currently subscribed to ntfsd as: xxxxx@comcast.net To unsubscribe send a blank email to xxxxx@lists.osr.com

Rohit_Gauba · July 24, 2006, 6:54am

Thanks Matt for the information

Is it possible to query for the file system in the dispatch or completion
routine of mount volume Irp (IRP_MJ_FILE_SYSTEM_CONTROL
::IRP_MN_MOUNT_VOLUME).

Reason for asking this is, In the code of filespy the function
CASpyFsNotification is notified first before any volume is mouted

On 7/24/06, matt wrote:
>
> ask the archive:
> http://www.osronline.com/showThread.cfm?link=15865
>
> m.
>
> ----- Original Message -----
> From: Rohit
> To: Windows File Systems Devs Interest List
> Sent: Monday, July 24, 2006 5:09 AM
> Subject: [ntfsd] detecting file system loaded on the mouted volume
>
>
>
> when File Object comes to us at vol mnt time , can we find out which FS
> would be loaded corresponding to it, either in the dispatcher routine or
> in the completion routine?
>
> Also if we use backup utility from start->Programs->Accessories->system
> tools for taking backup
>
> Then a new device with name \Device\HardDiskVolumeShadowCopy1 is mounted.
> Can any one explain me what’s the purpose of that
> — Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17 You are currently subscribed
> to ntfsd as: xxxxx@comcast.net To unsubscribe send a blank email to
> xxxxx@lists.osr.com
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
>
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

OSR_Community_User · July 24, 2006, 7:27am

If you were asking me, uhhh, I don’t know. I’ve never tried to do this before - hopefully one of the professionals here can answer this for you.

Not that it matters, but my gut instinct (which is meaningless) tells me you could probably get away with this in the mount completion… The info should be ready at that time; I would think…

m.
----- Original Message -----
From: Rohit
To: Windows File Systems Devs Interest List
Sent: Monday, July 24, 2006 5:53 AM
Subject: Re: [ntfsd] detecting file system loaded on the mouted volume

Thanks Matt for the information

Is it possible to query for the file system in the dispatch or completion routine of mount volume Irp (IRP_MJ_FILE_SYSTEM_CONTROL ::IRP_MN_MOUNT_VOLUME).

Reason for asking this is, In the code of filespy the function CASpyFsNotification is notified first before any volume is mouted

On 7/24/06, matt wrote:
ask the archive:
http://www.osronline.com/showThread.cfm?link=15865

m.
----- Original Message -----
From: Rohit
To: Windows File Systems Devs Interest List
Sent: Monday, July 24, 2006 5:09 AM
Subject: [ntfsd] detecting file system loaded on the mouted volume

when File Object comes to us at vol mnt time , can we find out which FS
would be loaded corresponding to it, either in the dispatcher routine or in the completion routine?

Also if we use backup utility from start->Programs->Accessories->system tools for taking backup

Then a new device with name \Device\HardDiskVolumeShadowCopy1 is mounted. Can any one explain me what’s the purpose of that

— Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17 You are currently subscribed to ntfsd as: xxxxx@comcast.net To unsubscribe send a blank email to xxxxx@lists.osr.com
—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

— Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17 You are currently subscribed to ntfsd as: xxxxx@comcast.net To unsubscribe send a blank email to xxxxx@lists.osr.com

deepumon_es · July 24, 2006, 8:04am

I cannot find CASpyFsNotification my filespy sample, but SpyFsNotification
is there. This is the FS register notification function which will call when
a new FS resister/unregister. One way to get the FS dev obj is, attach a
filter for each FileSystem(or the particular File System that you have
interest) in the FS register notification and get the IRP_MN_MOUNT_VOLUME
while mounting a new vol:. From the completion routine, check the RealDevice
in ‘MountVolume.Vpb’ in the irp stack loc:. This is the vol device obj.
Check the Vpb->DeviceObject of this vol dev obj, this will be the FS dev
obj. Hope this is what you want.
~Sisimon

On 7/24/06, matt wrote:
>
> If you were asking me, uhhh, I don’t know. I’ve never tried to do this
> before - hopefully one of the professionals here can answer this for you.
>
> Not that it matters, but my gut instinct (which is meaningless) tells me
> you could probably get away with this in the mount completion… The info
> should be ready at that time; I would think…
>
> m.
>
> ----- Original Message -----
> From: Rohit
> To: Windows File Systems Devs Interest List
> Sent: Monday, July 24, 2006 5:53 AM
> Subject: Re: [ntfsd] detecting file system loaded on the mouted volume
>
>
> Thanks Matt for the information
>
> Is it possible to query for the file system in the dispatch or completion
> routine of mount volume Irp (IRP_MJ_FILE_SYSTEM_CONTROL
> ::IRP_MN_MOUNT_VOLUME).
>
> Reason for asking this is, In the code of filespy the function
> CASpyFsNotification is notified first before any volume is mouted
>
>
>
>
> On 7/24/06, matt wrote:
> >
> > ask the archive:
> > http://www.osronline.com/showThread.cfm?link=15865
> >
> > m.
> >
> > ----- Original Message -----
> > From: Rohit
> > To: Windows File Systems Devs Interest List
> > Sent: Monday, July 24, 2006 5:09 AM
> > Subject: [ntfsd] detecting file system loaded on the mouted volume
> >
> >
> >
> >
> >
> > when File Object comes to us at vol mnt time , can we find out which FS
> > would be loaded corresponding to it, either in the dispatcher routine
> > or in the completion routine?
> >
> > Also if we use backup utility from start->Programs->Accessories->system
> > tools for taking backup
> >
> > Then a new device with name \Device\HardDiskVolumeShadowCopy1 is
> > mounted. Can any one explain me what’s the purpose of that
> > — Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> > You are currently subscribed to ntfsd as: xxxxx@comcast.net To
> > unsubscribe send a blank email to xxxxx@lists.osr.com
> > —
> > Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> >
> >
> > You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
> > ‘’
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
>
> — Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17 You are currently subscribed
> to ntfsd as: xxxxx@comcast.net To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
>
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

–
GCS d+ s: a- c++++ U> B+ L++>$ w++++$ W++(+++) PGP+N+ t PS+PE++ tv+(++) b+++
G+++ e++>(++++) h-- r
Don’t know this? See http://www.geekcode.com/geek.html

OSR_Community_User · July 24, 2006, 3:27pm

> while mounting a new vol:. From the completion routine, check the RealDevice

in ‘MountVolume.Vpb’ in the irp stack loc:. This is the vol device obj.

No, RealDevice is the blockwise volume device - \Device\HarddiskVolume%d.

Check the Vpb->DeviceObject of this vol dev obj, this will be the FS dev
obj.

Yes, this one is the FSD’s volume device object.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

deepumon_es · July 25, 2006, 1:40am

Rohit, If you have the volume device obj (yes, it is blockwise), you don’t
need to do all there filtering. You can directly check the VPB and get
DeviceObject(if ‘DeviceObject’ is null, then not mounted). It is not clear
the scenario from your problem description.

~Sisimon

On 7/25/06, Maxim S. Shatskih wrote:
>
> > while mounting a new vol:. From the completion routine, check the
> RealDevice
> > in ‘MountVolume.Vpb’ in the irp stack loc:. This is the vol device obj.
>
> No, RealDevice is the blockwise volume device - \Device\HarddiskVolume%d.
>
> > Check the Vpb->DeviceObject of this vol dev obj, this will be the FS dev
> > obj.
>
> Yes, this one is the FSD’s volume device object.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

–
GCS d+ s: a- c++++ U> B+ L++>$ w++++$ W++(+++) PGP+N+ t PS+PE++ tv+(++) b+++
G+++ e++>(++++) h-- r
Don’t know this? See http://www.geekcode.com/geek.html

Rohit_Gauba · July 25, 2006, 6:12am

Thanks for the reply

another question

If the volume is mounted, how can we check whether it is formatted or not?

On 7/25/06, Sisimon E S wrote:
>
> Rohit, If you have the volume device obj (yes, it is blockwise), you
> don’t need to do all there filtering. You can directly check the VPB and get
> DeviceObject(if ‘DeviceObject’ is null, then not mounted). It is not clear
> the scenario from your problem description.
>
> ~Sisimon
>
>
> On 7/25/06, Maxim S. Shatskih wrote:
>
> > > while mounting a new vol:. From the completion routine, check the
> RealDevice
> > in 'MountVolume.Vpb ’ in the irp stack loc:. This is the vol device
> obj.
>
> No, RealDevice is the blockwise volume device - \Device\HarddiskVolume%d.
>
> > Check the Vpb->DeviceObject of this vol dev obj, this will be the FS dev
>
> > obj.
>
> Yes, this one is the FSD’s volume device object.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
>
> –
> GCS d+ s: a- c++++ U> B+ L++>$ w++++$ W++(+++) PGP+N+ t PS+PE++ tv+(++)
> b+++ G+++ e++>(++++) h-- r
> Don’t know this? See http://www.geekcode.com/geek.html — Questions?
> First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17 You
> are currently subscribed to ntfsd as: xxxxx@gmail.com To unsubscribe send
> a blank email to xxxxx@lists.osr.com
>

deepumon_es · July 25, 2006, 8:20am

Cannot understand your question. With out formatting the volume how FS
Recognizer can detect the volume ?. If the volume is not formatted then FS
recognizer for each FS check the partitiontable/signature and finally reach
the RAW FS.

There is a beautiful article abt FS Rec on OSR. Check it on the OSR White
paper section in the ddk help.

~Sisimon

On 7/25/06, Rohit wrote:
>
> Thanks for the reply
>
> another question
>
> If the volume is mounted, how can we check whether it is formatted or not?
>
>
> On 7/25/06, Sisimon E S wrote:
>
> > Rohit, If you have the volume device obj (yes, it is blockwise), you
> don’t need to do all there filtering. You can directly check the VPB and get
> DeviceObject(if ‘DeviceObject’ is null, then not mounted). It is not clear
> the scenario from your problem description.
>
> ~Sisimon
>
>
> On 7/25/06, Maxim S. Shatskih < xxxxx@storagecraft.com> wrote:
>
> > > while mounting a new vol:. From the completion routine, check the
> RealDevice
> > in 'MountVolume.Vpb ’ in the irp stack loc:. This is the vol device
> obj.
>
> No, RealDevice is the blockwise volume device - \Device\HarddiskVolume%d.
>
> > Check the Vpb->DeviceObject of this vol dev obj, this will be the FS dev
>
> > obj.
>
> Yes, this one is the FSD’s volume device object.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
>
> –
> GCS d+ s: a- c++++ U> B+ L++>$ w++++$ W++(+++) PGP+N+ t PS+PE++ tv+(++)
> b+++ G+++ e++>(++++) h-- r
> Don’t know this? See http://www.geekcode.com/geek.html — Questions?
> First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17 You
> are currently subscribed to ntfsd as: xxxxx@gmail.com To unsubscribe send
> a blank email to xxxxx@lists.osr.com
>
>
> — Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17 You are currently subscribed
> to ntfsd as: xxxxx@gmail.com To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>

–
GCS d+ s: a- c++++ U> B+ L++>$ w++++$ W++(+++) PGP+N+ t PS+PE++ tv+(++) b+++
G+++ e++>(++++) h-- r
Don’t know this? See http://www.geekcode.com/geek.html