Disk filter driver

NTDEV
1

Hi all,

I want to write upper disk filter driver targetting a particular volume.
How to attach a disk filter driver to a specific drive or volume only??
How to capture Read/Write requests for files only i.e. how to check whether
a particular Read/Write call
is for normal file(i.e. I don’t want to handle file’s metadata related
calls)?
How can I get file information in disk filter driver?

–
Kapil Bhadke

2

> I want to write upper disk filter driver targetting a particular volume.

How to attach a disk filter driver to a specific drive or?volume?only??
How to capture Read/Write requests for files only i.e. how to check whether
a particular Read/Write call
is for normal file(i.e. I don’t want to handle file’s metadata related
calls)?
How can I get file information in disk filter driver?

If you want to trap file read/writes then use file system filter driver.
Volume filter driver will not get file related info, they will be
getting request for sector read/write.

-santosh k

3

>

If you want to trap file read/writes then use file system filter driver.
Volume filter driver will not get file related info, they will be
getting request for sector read/write.

Thats perfectly fine. But what I want is read/write request in terms of
sector blocks along with file information for which that call is initiated.
Is there any way that I could pass file information from minifilter driver
to disk filter driver??
i.e. anyhow create 1 data structure and minifilter will store needed
information in that data structure and disk filter then retrieve it??

–
Kapil Bhadke

4

Why do you want this? I.E. What is your base goal here?

Don Burn (MVP, Windows DKD)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

“kapil bhadke” wrote in message
news:xxxxx@ntdev:

> >
> > If you want to trap file read/writes then use file system filter driver.
> > Volume filter driver will not get file related info, they will be
> > getting request for sector read/write.
> >
> > Thats perfectly fine. But what I want is read/write request in terms of
> sector blocks along with file information for which that call is initiated.
> Is there any way that I could pass file information from minifilter driver
> to disk filter driver??
> i.e. anyhow create 1 data structure and minifilter will store needed
> information in that data structure and disk filter then retrieve it??
>
>
> –
> Kapil Bhadke

5

Why do you want this? I.E. What is your base goal here?

My ultimate goal is to write a driver for encryption/decryption same as EFS
but with some extra features added.
So if I write file system filter driver then I am facing following problems

  1. Read/Write requests are not in terms of disk blocks which I needed
  2. If I go on writing 1-1 byte in any file then I will have to handle these
    requests for each write request above the file system which I could have
    eliminated if I write disk filter driver.

–
Kapil Bhadke

6

It is easy to distinguish the non-cached writes (i.e. block writes) in a
mini-filter. Of course this means the data in cache is unencrypted.
This really should move to NTFSD since it requires a file system.

Don Burn (MVP, Windows DKD)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

“kapil bhadke” wrote in message
news:xxxxx@ntdev:

> Why do you want this? I.E. What is your base goal here?
> >
>
> My ultimate goal is to write a driver for encryption/decryption same as EFS
> but with some extra features added.
> So if I write file system filter driver then I am facing following problems
> 1. Read/Write requests are not in terms of disk blocks which I needed
> 2. If I go on writing 1-1 byte in any file then I will have to handle these
> requests for each write request above the file system which I could have
> eliminated if I write disk filter driver.
>
>
> –
> Kapil Bhadke