determine if the FILE_OBJECT represents a file or a directory

Rajesh_Gupta · January 21, 2009, 8:26pm

I read the FAQ on the OSR website. I queried the underneath file system by querying for FileStandardInformation. But IoCallDriver function call fails with Invalid Parameter. When i called the same function from CreateComplete, it succeeded. So i understand that file needs to be opened for this to work. I need this information in the Create, when the underneath file is not open.

Another trick given in the FAQ is “by examining the attributes within the directory” which can be done without file being opened.

I did not quite get this statement and how do i examine the attributes within the directory?
Any sample code would be great help as well.

thanks
Raj

here is the FAQ?
Q58 How do I determine if the FILE_OBJECT represents a file or a directory from my filter driver? Can I rely upon the FILE_DIRECTORY_FILE bit?

The determination of whether or not a given FILE_OBJECT represents a directory is the sole domain of the file system driver. Thus, for a file system filter driver to determine if a file is a directory, it must ask the file system. This can be done by querying the attributes of the file (e.g., after it has been successfully opened by the underlying file system) or by examining the attributes within the directory, which can be done before the underlying file has been opened.

Petr_Kurtin · January 21, 2009, 9:56pm

In the pre-IRP_MJ_CREATE callback, you can’t perform an I/O on the given
FileObject, because it’s not fully initialized yet and the file/folder isn’t
even opened.

If you can wait for the information (whether FILE_OBJECT represents a file
or a directory) to your completion routine (CreateComplete), do that. Just
check IRP’s status code, get FileObject’s FileStandardInformation and check
Directory value.

Input IRP_MJ_CREATE flags don’t tell you if such request opens a file or a
folder, you have to ask file system for additional information to be sure,
it means:

if CreateOptions contained FILE_DIRECTORY_FILE or
FILE_NON_DIRECTORY_FILE, you can trust the flags
if CreateOptions didn’t contain any of the two flags, you must
perform additional query

o if CreateDispostion contained FILE_CREATE/FILE_OPEN_IF and if a
file/folder with the same name exists (i.e. you MUST ask file-system),
this IRP will fail (STATUS_OBJECT_NAME_COLLISION)

o otherwise, you must open the given file/folder and query for its attrib

-pk

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: 22. ledna 2009 2:28
To: Windows File Systems Devs Interest List
Subject: [ntfsd] determine if the FILE_OBJECT represents a file or a
directory

I read the FAQ on the OSR website. I queried the underneath file system by
querying for FileStandardInformation. But IoCallDriver function call fails
with Invalid Parameter. When i called the same function from CreateComplete,
it succeeded. So i understand that file needs to be opened for this to work.
I need this information in the Create, when the underneath file is not open.

Another trick given in the FAQ is “by examining the attributes within the
directory” which can be done without file being opened.

I did not quite get this statement and how do i examine the attributes
within the directory?

Any sample code would be great help as well.

thanks

Raj

here is the FAQ?

Q58 How do I determine if the FILE_OBJECT represents a file or a directory
from my filter driver? Can I rely upon the FILE_DIRECTORY_FILE bit?

The determination of whether or not a given FILE_OBJECT represents a
directory is the sole domain of the file system driver. Thus, for a file
system filter driver to determine if a file is a directory, it must ask the
file system. This can be done by querying the attributes of the file (e.g.,
after it has been successfully opened by the underlying file system) or by
examining the attributes within the directory, which can be done before the
underlying file has been opened.

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars

(including our new fs mini-filter seminar) visit:

http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@avast.com

To unsubscribe send a blank email to xxxxx@lists.osr.com

Ken_Johnson · January 21, 2009, 10:24pm

Of course, opening the target file to figure out what sort of file it is before allowing the original request to go through has its own whole can of (race condition) worms, as previously discusses on the list.

? S

From: Petr Kurtin
Sent: Wednesday, January 21, 2009 18:56
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] determine if the FILE_OBJECT represents a file or a directory

In the pre-IRP_MJ_CREATE callback, you can’t perform an I/O on the given FileObject, because it’s not fully initialized yet and the file/folder isn’t even opened.

If you can wait for the information (whether FILE_OBJECT represents a file or a directory) to your completion routine (CreateComplete), do that. Just check IRP’s status code, get FileObject’s FileStandardInformation and check Directory value.

Input IRP_MJ_CREATE flags don’t tell you if such request opens a file or a folder, you have to ask file system for additional information to be sure, it means:

- if CreateOptions contained FILE_DIRECTORY_FILE or FILE_NON_DIRECTORY_FILE, you can trust the flags

- if CreateOptions didn’t contain any of the two flags, you must perform additional query

o if CreateDispostion contained FILE_CREATE/FILE_OPEN_IF and if a file/folder with the same name exists (i.e. you MUST ask file-system), this IRP will fail (STATUS_OBJECT_NAME_COLLISION)

o otherwise, you must open the given file/folder and query for its attrib

-pk

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: 22. ledna 2009 2:28
To: Windows File Systems Devs Interest List
Subject: [ntfsd] determine if the FILE_OBJECT represents a file or a directory

I read the FAQ on the OSR website. I queried the underneath file system by querying for FileStandardInformation. But IoCallDriver function call fails with Invalid Parameter. When i called the same function from CreateComplete, it succeeded. So i understand that file needs to be opened for this to work. I need this information in the Create, when the underneath file is not open.

Another trick given in the FAQ is “by examining the attributes within the directory” which can be done without file being opened.

I did not quite get this statement and how do i examine the attributes within the directory?

Any sample code would be great help as well.

thanks

Raj

here is the FAQ?

Q58 How do I determine if the FILE_OBJECT represents a file or a directory from my filter driver? Can I rely upon the FILE_DIRECTORY_FILE bit?

The determination of whether or not a given FILE_OBJECT represents a directory is the sole domain of the file system driver. Thus, for a file system filter driver to determine if a file is a directory, it must ask the file system. This can be done by querying the attributes of the file (e.g., after it has been successfully opened by the underlying file system) or by examining the attributes within the directory, which can be done before the underlying file has been opened.

—

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars

(including our new fs mini-filter seminar) visit:

http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@avast.com

To unsubscribe send a blank email to xxxxx@lists.osr.com

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Petr_Kurtin · January 21, 2009, 10:52pm

instead opening the file, you can send IRP_MJ_DIRECTORY_CONTROL to find out
if such file/folder with the same name exists or not…

-pk

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Skywing
Sent: 22. ledna 2009 4:23
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] determine if the FILE_OBJECT represents a file or a
directory

Of course, opening the target file to figure out what sort of file it is
before allowing the original request to go through has its own whole can of
(race condition) worms, as previously discusses on the list.

S

From: Petr Kurtin
Sent: Wednesday, January 21, 2009 18:56
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] determine if the FILE_OBJECT represents a file or a
directory

In the pre-IRP_MJ_CREATE callback, you can’t perform an I/O on the given
FileObject, because it’s not fully initialized yet and the file/folder isn’t
even opened.

If you can wait for the information (whether FILE_OBJECT represents a file
or a directory) to your completion routine (CreateComplete), do that. Just
check IRP’s status code, get FileObject’s FileStandardInformation and check
Directory value.

Input IRP_MJ_CREATE flags don’t tell you if such request opens a file or a
folder, you have to ask file system for additional information to be sure,
it means:

- if CreateOptions contained FILE_DIRECTORY_FILE or
FILE_NON_DIRECTORY_FILE, you can trust the flags

- if CreateOptions didn’t contain any of the two flags, you must
perform additional query

o if CreateDispostion contained FILE_CREATE/FILE_OPEN_IF and if a
file/folder with the same name exists (i.e. you MUST ask file-system),
this IRP will fail (STATUS_OBJECT_NAME_COLLISION)

o otherwise, you must open the given file/folder and query for its attrib

-pk

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: 22. ledna 2009 2:28
To: Windows File Systems Devs Interest List
Subject: [ntfsd] determine if the FILE_OBJECT represents a file or a
directory

I read the FAQ on the OSR website. I queried the underneath file system by
querying for FileStandardInformation. But IoCallDriver function call fails
with Invalid Parameter. When i called the same function from CreateComplete,
it succeeded. So i understand that file needs to be opened for this to work.
I need this information in the Create, when the underneath file is not open.

Another trick given in the FAQ is “by examining the attributes within the
directory” which can be done without file being opened.

I did not quite get this statement and how do i examine the attributes
within the directory?

Any sample code would be great help as well.

thanks

Raj

here is the FAQ?

Q58 How do I determine if the FILE_OBJECT represents a file or a directory
from my filter driver? Can I rely upon the FILE_DIRECTORY_FILE bit?

The determination of whether or not a given FILE_OBJECT represents a
directory is the sole domain of the file system driver. Thus, for a file
system filter driver to determine if a file is a directory, it must ask the
file system. This can be done by querying the attributes of the file (e.g.,
after it has been successfully opened by the underlying file system) or by
examining the attributes within the directory, which can be done before the
underlying file has been opened.

—

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars

(including our new fs mini-filter seminar) visit:

http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@avast.com

To unsubscribe send a blank email to xxxxx@lists.osr.com

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Ken_Johnson · January 21, 2009, 11:07pm

I’m not sure how that addresses the underlying race, though (someone deleting and creating anew the file name requested between your directory control request and the original create request going through). You would have to hold a lock serializing all (or some set) of creates across the new request to the underlying FS. Is that really something that you can safely do?

? S

From: Petr Kurtin
Sent: Wednesday, January 21, 2009 19:53
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] determine if the FILE_OBJECT represents a file or a directory

instead opening the file, you can send IRP_MJ_DIRECTORY_CONTROL to find out if such file/folder with the same name exists or not…
-pk

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Skywing
Sent: 22. ledna 2009 4:23
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] determine if the FILE_OBJECT represents a file or a directory

Of course, opening the target file to figure out what sort of file it is before allowing the original request to go through has its own whole can of (race condition) worms, as previously discusses on the list.

? S
________________________________
From: Petr Kurtin
Sent: Wednesday, January 21, 2009 18:56
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] determine if the FILE_OBJECT represents a file or a directory

In the pre-IRP_MJ_CREATE callback, you can’t perform an I/O on the given FileObject, because it’s not fully initialized yet and the file/folder isn’t even opened.

If you can wait for the information (whether FILE_OBJECT represents a file or a directory) to your completion routine (CreateComplete), do that. Just check IRP’s status code, get FileObject’s FileStandardInformation and check Directory value.

Input IRP_MJ_CREATE flags don’t tell you if such request opens a file or a folder, you have to ask file system for additional information to be sure, it means:

- if CreateOptions contained FILE_DIRECTORY_FILE or FILE_NON_DIRECTORY_FILE, you can trust the flags

- if CreateOptions didn’t contain any of the two flags, you must perform additional query

o if CreateDispostion contained FILE_CREATE/FILE_OPEN_IF and if a file/folder with the same name exists (i.e. you MUST ask file-system), this IRP will fail (STATUS_OBJECT_NAME_COLLISION)

o otherwise, you must open the given file/folder and query for its attrib

-pk

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: 22. ledna 2009 2:28
To: Windows File Systems Devs Interest List
Subject: [ntfsd] determine if the FILE_OBJECT represents a file or a directory

I read the FAQ on the OSR website. I queried the underneath file system by querying for FileStandardInformation. But IoCallDriver function call fails with Invalid Parameter. When i called the same function from CreateComplete, it succeeded. So i understand that file needs to be opened for this to work. I need this information in the Create, when the underneath file is not open.

Another trick given in the FAQ is “by examining the attributes within the directory” which can be done without file being opened.

I did not quite get this statement and how do i examine the attributes within the directory?

Any sample code would be great help as well.

thanks

Raj

here is the FAQ?

Q58 How do I determine if the FILE_OBJECT represents a file or a directory from my filter driver? Can I rely upon the FILE_DIRECTORY_FILE bit?

The determination of whether or not a given FILE_OBJECT represents a directory is the sole domain of the file system driver. Thus, for a file system filter driver to determine if a file is a directory, it must ask the file system. This can be done by querying the attributes of the file (e.g., after it has been successfully opened by the underlying file system) or by examining the attributes within the directory, which can be done before the underlying file has been opened.

—

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars

(including our new fs mini-filter seminar) visit:

http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@avast.com

To unsubscribe send a blank email to xxxxx@lists.osr.com

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

OSR_Community_User · January 22, 2009, 2:58am

No, you cannot safely hold a lock across a call from a filter to the
underlying file system. Certainly there are those that do it, but
hopefully they understand that this runs the very real risk of deadlock.

The BEST way to figure out what something is would be to allow the
original open to proceed, ask (in post-create) and then use that
information as appropriate. The problem with any other approach is
that the answer you receive is true at the moment you get the response
BUT it isn’t necessarily true one moment later…

Tony

OSR

Daniel_Terhell · January 22, 2009, 4:46am

That should not be an issue as that causes a new file object to be created.

//Daniel

“Skywing” wrote in message news:xxxxx@ntfsd…
I’m not sure how that addresses the underlying race, though (someone deleting and creating anew the file name requested between your directory control request and the original create request going through).
? S

------------------------------------------------------------------------------
From: Petr Kurtin
Sent: Wednesday, January 21, 2009 19:53
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] determine if the FILE_OBJECT represents a file or a directory

instead opening the file, you can send IRP_MJ_DIRECTORY_CONTROL to find out if such file/folder with the same name exists or not…

-pk

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Skywing
Sent: 22. ledna 2009 4:23
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] determine if the FILE_OBJECT represents a file or a directory

Of course, opening the target file to figure out what sort of file it is before allowing the original request to go through has its own whole can of (race condition) worms, as previously discusses on the list.

? S

------------------------------------------------------------------------------

From: Petr Kurtin
Sent: Wednesday, January 21, 2009 18:56
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] determine if the FILE_OBJECT represents a file or a directory

In the pre-IRP_MJ_CREATE callback, you can’t perform an I/O on the given FileObject, because it’s not fully initialized yet and the file/folder isn’t even opened.

If you can wait for the information (whether FILE_OBJECT represents a file or a directory) to your completion routine (CreateComplete), do that. Just check IRP’s status code, get FileObject’s FileStandardInformation and check Directory value.

Input IRP_MJ_CREATE flags don’t tell you if such request opens a file or a folder, you have to ask file system for additional information to be sure, it means:

- if CreateOptions contained FILE_DIRECTORY_FILE or FILE_NON_DIRECTORY_FILE, you can trust the flags

- if CreateOptions didn’t contain any of the two flags, you must perform additional query

o if CreateDispostion contained FILE_CREATE/FILE_OPEN_IF and if a file/folder with the same name exists (i.e. you MUST ask file-system), this IRP will fail (STATUS_OBJECT_NAME_COLLISION)

o otherwise, you must open the given file/folder and query for its attrib

-pk

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: 22. ledna 2009 2:28
To: Windows File Systems Devs Interest List
Subject: [ntfsd] determine if the FILE_OBJECT represents a file or a directory

I read the FAQ on the OSR website. I queried the underneath file system by querying for FileStandardInformation. But IoCallDriver function call fails with Invalid Parameter. When i called the same function from CreateComplete, it succeeded. So i understand that file needs to be opened for this to work. I need this information in the Create, when the underneath file is not open.

Another trick given in the FAQ is “by examining the attributes within the directory” which can be done without file being opened.

I did not quite get this statement and how do i examine the attributes within the directory?

Any sample code would be great help as well.

thanks

Raj

here is the FAQ?

Q58 How do I determine if the FILE_OBJECT represents a file or a directory from my filter driver? Can I rely upon the FILE_DIRECTORY_FILE bit?

The determination of whether or not a given FILE_OBJECT represents a directory is the sole domain of the file system driver. Thus, for a file system filter driver to determine if a file is a directory, it must ask the file system. This can be done by querying the attributes of the file (e.g., after it has been successfully opened by the underlying file system) or by examining the attributes within the directory, which can be done before the underlying file has been opened.

—

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars

(including our new fs mini-filter seminar) visit:

http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@avast.com

To unsubscribe send a blank email to xxxxx@lists.osr.com

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Ariel_K · January 22, 2009, 5:02am

You can also manipulate the create disposition to be FILE_OPEN,
and if creation failed handle it accordingly - recreate with the another disposition.
if creation succeeded you can query the file object received.

Ariel.

Ken_Johnson · January 22, 2009, 12:21pm

How does this block the race? You can’t keep the pre-created FO alive for sharing/exclusivity issues.

? S

From: xxxxx@resplendence.com
Sent: Thursday, January 22, 2009 01:46
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] determine if the FILE_OBJECT represents a file or a directory

That should not be an issue as that causes a new file object to be created.

//Daniel

“Skywing” > wrote in message news:xxxxx@ntfsd…
I’m not sure how that addresses the underlying race, though (someone deleting and creating anew the file name requested between your directory control request and the original create request going through).
? S

From: Petr Kurtin
Sent: Wednesday, January 21, 2009 19:53
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] determine if the FILE_OBJECT represents a file or a directory

instead opening the file, you can send IRP_MJ_DIRECTORY_CONTROL to find out if such file/folder with the same name exists or not…
-pk

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Skywing
Sent: 22. ledna 2009 4:23
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] determine if the FILE_OBJECT represents a file or a directory

Of course, opening the target file to figure out what sort of file it is before allowing the original request to go through has its own whole can of (race condition) worms, as previously discusses on the list.

? S

From: Petr Kurtin
Sent: Wednesday, January 21, 2009 18:56
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] determine if the FILE_OBJECT represents a file or a directory

In the pre-IRP_MJ_CREATE callback, you can’t perform an I/O on the given FileObject, because it’s not fully initialized yet and the file/folder isn’t even opened.

If you can wait for the information (whether FILE_OBJECT represents a file or a directory) to your completion routine (CreateComplete), do that. Just check IRP’s status code, get FileObject’s FileStandardInformation and check Directory value.

Input IRP_MJ_CREATE flags don’t tell you if such request opens a file or a folder, you have to ask file system for additional information to be sure, it means:

- if CreateOptions contained FILE_DIRECTORY_FILE or FILE_NON_DIRECTORY_FILE, you can trust the flags

- if CreateOptions didn’t contain any of the two flags, you must perform additional query

o if CreateDispostion contained FILE_CREATE/FILE_OPEN_IF and if a file/folder with the same name exists (i.e. you MUST ask file-system), this IRP will fail (STATUS_OBJECT_NAME_COLLISION)

o otherwise, you must open the given file/folder and query for its attrib

-pk

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: 22. ledna 2009 2:28
To: Windows File Systems Devs Interest List
Subject: [ntfsd] determine if the FILE_OBJECT represents a file or a directory

I read the FAQ on the OSR website. I queried the underneath file system by querying for FileStandardInformation. But IoCallDriver function call fails with Invalid Parameter. When i called the same function from CreateComplete, it succeeded. So i understand that file needs to be opened for this to work. I need this information in the Create, when the underneath file is not open.

Another trick given in the FAQ is “by examining the attributes within the directory” which can be done without file being opened.

I did not quite get this statement and how do i examine the attributes within the directory?

Any sample code would be great help as well.

thanks

Raj

here is the FAQ?

Q58 How do I determine if the FILE_OBJECT represents a file or a directory from my filter driver? Can I rely upon the FILE_DIRECTORY_FILE bit?

The determination of whether or not a given FILE_OBJECT represents a directory is the sole domain of the file system driver. Thus, for a file system filter driver to determine if a file is a directory, it must ask the file system. This can be done by querying the attributes of the file (e.g., after it has been successfully opened by the underlying file system) or by examining the attributes within the directory, which can be done before the underlying file has been opened.

—

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars

(including our new fs mini-filter seminar) visit:

http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@avast.com

To unsubscribe send a blank email to xxxxx@lists.osr.com

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Rajesh_Gupta · January 22, 2009, 12:46pm

Thanks everyone for the response. I really appreciate this.

I was thinking of using the SHADOW OBJECT to open the file and then query the file system to avoid all these sync issue discussed above.

Also, which is this technique mentioned in the FAQ? What is the meaning of examining the attributes?

" by examining the attributes within the directory, which can be done before the underlying file has been opened. "

thanks

Gabriel_Bercea · January 22, 2009, 1:10pm

Your safest bet, would be to make all these queries in CREATE.
You can either check the flags FILE_DIRECTORY_FILE or
FILE_NON_DIRECTORY_FILE in pre-create. Most of the time this will work. It’s
simple if the request succeeds then you associate this with FsContext and
you got yourself this attribute for the FO.
You should consider cancel opens and ofcourse IRP alterations down the
stack.

With respect,
Gabriel Bercea

GaMiTech Software Development
Mobile contact: (+40)0740049634
eMail: xxxxx@gmail.com

OSR_Community_User · January 22, 2009, 1:11pm

I think that technique means that if you open the parent directory of the FILE_OBJECT you’ve just seen (you want this in pre-create, right?) and enumerate the contents of the directory (using a wildcard can help eliminate uninteresting entries) and by requesting an information class that returns FileAttributes (FileDirectoryInformation, FileBothDirectoryInformation and such) you can find if the file you’re about to open was a directory or a file at the time that the query was completed.

The more reliable way (as has been already pointed out) is to check after the file has been opened (post-create). But since you say you need this information in pre-create…

It would be useful if you could provide more information about you are trying to accomplish since there may an alternative solution that would work with querying in post-create and make things easier.

Regards,
Alex.
This posting is provided “AS IS” with no warranties, and confers no rights.

Petr_Kurtin · January 22, 2009, 1:21pm

if CreateOptions didn’t contain FILE_DIRECTORY_FILE or
FILE_NON_DIRECTORY_FILE flag, you have to examine the attributes within the
directory. Open the file/folder with DEFAULT parameters set in the given IRP
(just change open mode to FILE_OPEN), if you open something, you have to
query FileObject for its type: build your own IRP request
(IRP_MJ_QUERY_INFORMATION/FileStandardInformation) and pass it to the driver
that is associated with the next-lower device object in the device stack.

-pk

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: 22. ledna 2009 18:48
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] determine if the FILE_OBJECT represents a file or a
directory

Thanks everyone for the response. I really appreciate this.

I was thinking of using the SHADOW OBJECT to open the file and then query
the file system to avoid all these sync issue discussed above.

Also, which is this technique mentioned in the FAQ? What is the meaning of
examining the attributes?

" by examining the attributes within the directory, which can be done before
the underlying file has been opened. "

thanks

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars

(including our new fs mini-filter seminar) visit:

http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@avast.com

To unsubscribe send a blank email to xxxxx@lists.osr.com

Ken_Johnson · January 22, 2009, 3:27pm

This is *still* subject to the same race as before if you try to query the parent directory. Think about what happens if the file is deleted and then a directory is created with the same name after you issue your query.

? S

From: Petr Kurtin
Sent: Thursday, January 22, 2009 10:23
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] determine if the FILE_OBJECT represents a file or a directory

if CreateOptions didn’t contain FILE_DIRECTORY_FILE or FILE_NON_DIRECTORY_FILE flag, you have to examine the attributes within the directory. Open the file/folder with DEFAULT parameters set in the given IRP (just change open mode to FILE_OPEN), if you open something, you have to query FileObject for its type: build your own IRP request (IRP_MJ_QUERY_INFORMATION/FileStandardInformation) and pass it to the driver that is associated with the next-lower device object in the device stack.

-pk

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: 22. ledna 2009 18:48
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] determine if the FILE_OBJECT represents a file or a directory

Thanks everyone for the response. I really appreciate this.

I was thinking of using the SHADOW OBJECT to open the file and then query the file system to avoid all these sync issue discussed above.

Also, which is this technique mentioned in the FAQ? What is the meaning of examining the attributes?

" by examining the attributes within the directory, which can be done before the underlying file has been opened. "

thanks

—

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars

(including our new fs mini-filter seminar) visit:

http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@avast.com

To unsubscribe send a blank email to xxxxx@lists.osr.com

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com