Different pattern of IRP sequence in case of Networked folder

NTFSD
1

Hi All,

While observing the IRP sequence for a file copy operation, i have noticed
one strange thing. I am having a network shared folder with writable access.
When i copied a file from this folder and paste into the same folder, i
observed a new pattern of IRP sequence (while running FILEMON on the local
system).
On doing Paste, the IRPs generation on the destination file are:

IRP_MJ_CREATE (File Overwritten)
.
.
IRP_MJ_CREATE (File Open: Write access)
.
.
.
IRP_MJ_CLEANUP
IRP_MJ_CLOSE
IRP_MJ_SET_INFORMATION
.
.
IRP_MJ_WRITE

Now my question is that, why is this strange behavior there in this case
(Create-> Open-> Cleanup-> Write).
Ideally, there should be a Cleanup after Create.

Thanks alot.

Regards,
Shreshth

2

Hi,
I do not see any strange thing.
The application may do

H1 = CreateFile( );
H2 = CreateFile( );
Close( H1 );
SetFileSize( H2 );
Write( H2 );
Close( H2 );

“Shreshth Luthra” wrote in message news:xxxxx@ntfsd…
Hi All,

While observing the IRP sequence for a file copy operation, i have noticed one strange thing. I am having a network shared folder with writable access. When i copied a file from this folder and paste into the same folder, i observed a new pattern of IRP sequence (while running FILEMON on the local system).
On doing Paste, the IRPs generation on the destination file are:

IRP_MJ_CREATE (File Overwritten)
.
.
IRP_MJ_CREATE (File Open: Write access)
.
.
.
IRP_MJ_CLEANUP
IRP_MJ_CLOSE
IRP_MJ_SET_INFORMATION
.
.
IRP_MJ_WRITE

Now my question is that, why is this strange behavior there in this case (Create-> Open-> Cleanup-> Write).
Ideally, there should be a Cleanup after Create.

Thanks alot.

Regards,
Shreshth

3

Hi Slava,

I am not talking about any ABC application doing it.
In my case, Explorer is doing so and i wanted to know that is there nay
specifc reason for this behavior.

I will be grateful if any1 can help me in this.

Thanks and Regards,

Shreshth

Re: Slava
>Hi,
I do not see any strange thing.
The application may do

H1 = CreateFile( );
H2 = CreateFile( );
Close( H1 );
SetFileSize( H2 );
Write( H2 );
Close( H2 );

Shreshth wrote:

Hi All,

While observing the IRP sequence for a file copy operation, i have noticed
one strange thing. I am having a network shared folder with writable access.
When i copied a file from this folder and paste into the same folder, i
observed a new pattern of IRP sequence (while running FILEMON on the local
system).
On doing Paste, the IRPs generation on the destination file are:

IRP_MJ_CREATE (File Overwritten)
.
.
IRP_MJ_CREATE (File Open: Write access)
.
.
.
IRP_MJ_CLEANUP
IRP_MJ_CLOSE
IRP_MJ_SET_INFORMATION
.
.
IRP_MJ_WRITE

Now my question is that, why is this strange behavior there in this case
(Create-> Open-> Cleanup-> Write).
Ideally, there should be a Cleanup after Create.

Thanks alot.

Regards,

Shreshth