determine physical disk from minifilter

NTDEV
1

Hi all,

is there a way to determine the physical disk on which
a particular volume resides from the InstanceSetup
routine of a FS minifilter? I mean, how could I determine
on which physical disk (hard disk 0, 1, … or cd-rom etc)
resides a volume like “\Device\HarddiskVolume14”?

thank you,

Sandor LUKACS
Virus Analyst, SOFTWIN

2

Start WinObj from Sysinternals or one of the equivalent applications and
under \Device\HarddiskX you will see symbolic links named after the
partition on which they reside. These symbolic links point just to the
names that you gave as an example.

Oliver

PS: In \Device\HarddiskX X is the number of the drive.

xxxxx@bitdefender.com wrote:

Hi all,

is there a way to determine the physical disk on which
a particular volume resides from the InstanceSetup
routine of a FS minifilter? I mean, how could I determine
on which physical disk (hard disk 0, 1, … or cd-rom etc)
resides a volume like “\Device\HarddiskVolume14”?

thank you,

Sandor LUKACS
Virus Analyst, SOFTWIN

3

thank you,

ok, I can see that; but how can I programatically get that list?

Sandor LUKACS

4

xxxxx@bitdefender.com wrote:

ok, I can see that; but how can I programatically get that list?

Try using ZwQueryDirectoryObject() to parse the object directory for all
names. Inside the HarddiskX object directories enumerate all the
symbolic links and use ZwQuerySymbolicLinkObject() to get the targets of
the links. Now compare the first part of the targets with the HarddiskX
object directories in which the respective symbolic link resides.

… of course all at IRQL PASSIVE_LEVEL. Best you cache it in some
buffer or list for faster lookup.

I know it is not beautiful :wink:

Oliver

5

There’s a volume management I/O control you can send to get the disk
extents in which the volume resides.

See IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS.

-p

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@bitdefender.com
Sent: Monday, October 30, 2006 7:05 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] determine physical disk from minifilter

thank you,

ok, I can see that; but how can I programatically get that list?

Sandor LUKACS

6

Use IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS and DISK_EXTENT::DiskNumber.

  • Jeremy Boschen

“Oliver Schneider” wrote in message news:xxxxx@ntdev…
> xxxxx@bitdefender.com wrote:
>> ok, I can see that; but how can I programatically get that list?
>
> Try using ZwQueryDirectoryObject() to parse the object directory for all
> names. Inside the HarddiskX object directories enumerate all the
> symbolic links and use ZwQuerySymbolicLinkObject() to get the targets of
> the links. Now compare the first part of the targets with the HarddiskX
> object directories in which the respective symbolic link resides.
>
> … of course all at IRQL PASSIVE_LEVEL. Best you cache it in some
> buffer or list for faster lookup.
>
> I know it is not beautiful :wink:
>
> Oliver
>

7

Jeremy Boschen wrote:

Use IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS and DISK_EXTENT::DiskNumber.

  • Jeremy Boschen

Jeremy,

thanks. I wasn’t aware of this one.

Oliver

8

Thank you for all!

to summarize up the whole thing for everyone:

  1. FltObjects->Volume is an opaque volume pointer in InstanceSetup
  2. with FltGetVolumeProperties we can get a RealDeviceName, like \Device\HarddiskVolume2
  3. with FltCreateFile / ObReferenceObjectByHandle we can open that device and get a file object pointer
  4. with FltDeviceIoControlFile / IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS we can get the disk extents, and those extents contain the physical DiskNumber
  5. one must use ObDereferenceObject and FltClose to release file handle and file object pointer

this seems to be working just fine; if anyone thinks something is wrong / inexact pls. tell me; I would appreciate;

have a nice day, thank you again,

Sandor LUKACS

9

IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS can help, send it to
\Device\HarddiskVolume%d

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From:
To: “Windows System Software Devs Interest List”
Sent: Monday, October 30, 2006 5:50 PM
Subject: [ntdev] determine physical disk from minifilter

> Hi all,
>
> is there a way to determine the physical disk on which
> a particular volume resides from the InstanceSetup
> routine of a FS minifilter? I mean, how could I determine
> on which physical disk (hard disk 0, 1, … or cd-rom etc)
> resides a volume like “\Device\HarddiskVolume14”?
>
> thank you,
>
> Sandor LUKACS
> Virus Analyst, SOFTWIN
>
> —
> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer