DriveLetter to DeviceObject

NTFSD
1

Hi
I am writing a driver(not a filter driver) that will write to the sectors of different partitions.
From user mode I get the drive letter C:, D: and E:
the devices under \Driver\Disk as show by device tree are
\Device\Harddisk0\DP(3)0x24ecd1e00-0x15c9406200+3
\Device\Harddisk0\DP(2)0xea609c000-0x15c8c2e000+2
\Device\Harddisk0\DP(1)0x7e00-0xea608c400+1
\Device\Harddisk0\DR0

I get these devices but how do I find out which device is for which partition?

2

You can always open the symbolic links and query their contents (from user mode) to determine how drive letters are being mapped to the underlying device. Of course, keep in mind multiple drive letters can map to the same drive, and drives do not need drive letters to be used.

Tony
OSR

3

Note also that many drive letters can map to the same physical drive, but
each could be mapped to a different subdirectory.

For example, I have X: on my server mqpped to a subdirectory which is the
shared subdirectory the server exports. There was a time when I used to
have drive M: mapped to where my compiler was, which was a subdirectory of
C:\program files\microsoft visual studio.…etc. So an assumption that a
drive letter is mapped to the root directory of a physical drive would
typically not be valid.
joe

You can always open the symbolic links and query their contents (from user
mode) to determine how drive letters are being mapped to the underlying
device. Of course, keep in mind multiple drive letters can map to the
same drive, and drives do not need drive letters to be used.

Tony
OSR

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

4

I could not understand. How do I query the contents?

5

QueryDosDevice()

mm

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Thursday, November 03, 2011 8:10 AM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] DriveLetter to DeviceObject

I could not understand. How do I query the contents?

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

6

I have a similar problem i cant find a solution for it, maybe someone knows a way to solve this, even a direction to look at would be great: I do have a Volume Letter e.g. C:, D:, the MountPoints for them and the native names like \Device\HarddiskVolume1. What i need, is to map these names to a device object of device class DiskDrive {4d36e967-e325-11ce-bfc1-08002be10318} in the device information set of a system, but i dont know where to start,…any ideas would be great!

tia

K.

7

Hi Kerem,

You should probably start a new thread if you have different question than the OP.

Anyway, please don’t use QueryDosDevice(). I’ve had enough issues with user mode code that uses that…

There is a page on MSDN, “Volume Management Functions” (currently at http://msdn.microsoft.com/en-us/library/windows/desktop/aa365730(v=vs.85).aspx) that lists a lot of functions that one can use to figure out the device mapping. In particular, for user mode, you can use GetVolumePathNamesForVolumeNameW to get the volume name for a file path and then you can use GetVolumeNameForVolumeMountPoint to get the NT volume name (the GUID name) and then you can use that name to query the MOUNTMGR and get the actualy device name. You need this steps because for any given path you can’t assume that the drive letter is the right device because volumes can be mounted in folders, so C:\mnt might be the actual volume name. Also, please note that volumes might not have a dos style volume name at all and still be perfectly find, but QueryDosDevice() will not find them…

Thanks,
Alex.

8

Hi Alex,

You should probably start a new thread if you have different question than the OP.

I already did, but got no answers. See here: http://www.osronline.com/showThread.CFM?link=214754

Anyway, please don’t use QueryDosDevice()

I dont, i use Nt/Zw usermode routines to get the most of it

There is a page on MSDN, “Volume Management Functions” … that lists a lot of functions,…

I am familiar with all these things, what i want is a little different here, but also a little in that OP’s direction, thats why i “attached” to that thread. See my OP on the link above. Do you have any ideas on that topic?

best

K.

9

I haven’t actually done this but I would start with
IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS. Hope it helps.

Thanks,
Alex.

10

Hi Alex,

thank you for the help. But how should i “map” that information to a device instance object in detail? Its clear from the documentation that you will get all the disks that reside on the volume, but how will i or can i map that to a device object or objects of type DiskDrive? I am still looking for some relation of a device instance node from the instances tree If do have a lot of information from both sides, from the volume/drive anything the windows api offers me, even including names and symbolic links from the object manager from alls drives and volumes i can enumerate on the system. I do have native names, mount points, links, etc. anything i can get. On the other end to the device in device manager i do have all device instance node information i can query with the SetupDi* apis, icluding the keys to the device, instance id, hardware id(s), compatible id(s) and all i can get from registry or setup/pnp api, all in user mode, no kernel code involved and will not be used.

K.

11

Hi
Thanks for replying.

I “don’t” want the device names that are under \Driver\Ftdisk i.e.
\Device\HarddiskVolume3
\Device\HarddiskVolume2
\Device\HarddiskVolume1

but I want those under \Driver\Disk i.e.
\Device\Harddisk0\DP(3)0x24ecd1e00-0x15c9406200+3
\Device\Harddisk0\DP(2)0xea609c000-0x15c8c2e000+2
\Device\Harddisk0\DP(1)0x7e00-0xea608c400+1
\Device\Harddisk0\DR0

12

Using the DriveNumber from the DISK_EXTENTS structure you can open
\.\PhysicalDriveX to get the disk device object.,

-scott

–
Scott Noone
Consulting Associate and Chief System Problem Analyst
OSR Open Systems Resources, Inc.
http://www.osronline.com

wrote in message news:xxxxx@ntfsd…

Hi Alex,

thank you for the help. But how should i “map” that information to a device
instance object in detail? Its clear from the documentation that you will
get all the disks that reside on the volume, but how will i or can i map
that to a device object or objects of type DiskDrive? I am still looking for
some relation of a device instance node from the instances tree If do have a
lot of information from both sides, from the volume/drive anything the
windows api offers me, even including names and symbolic links from the
object manager from alls drives and volumes i can enumerate on the system. I
do have native names, mount points, links, etc. anything i can get. On the
other end to the device in device manager i do have all device instance node
information i can query with the SetupDi* apis, icluding the keys to the
device, instance id, hardware id(s), compatible id(s) and all i can get from
registry or setup/pnp api, all in user mode, no kernel code involved and
will not be used.

K.

13

will \.\PhysicalDriveX not give the device object of the harddisk?
I want the device object of the partition.

14

Sorry if you mentioned this earlier, but why? Those device objects don’t
really mean anything. Also, if you have the disk device object and extent
information, so I don’t know what other information the partition DO would
give.

They also have two other issues:

  1. They have DO_DEVICE_INITIALIZING cleared, which means you can’t open them

  2. This is all changed in Vista, where the partition PDOs are created by the
    partition manager and not disk. So, anything you come up with will be O/S
    specific.

-scott

–
Scott Noone
Consulting Associate and Chief System Problem Analyst
OSR Open Systems Resources, Inc.
http://www.osronline.com

wrote in message news:xxxxx@ntfsd…

will \.\PhysicalDriveX not give the device object of the harddisk?
I want the device object of the partition.

15

But there seems to be an underlying assmption that a “drive letter” == “a
partition on a drive” which is fundamentally false. It can be a
subdirectory, even a subdirectory on a remote machine.

In my local world, the I: drive is my server, and is mapped to
\server5\x, but the x: drive on the server is mapped to c:\shared. So
what would it mean to “find the partition” for I:?
joe

Sorry if you mentioned this earlier, but why? Those device objects don’t
really mean anything. Also, if you have the disk device object and extent
information, so I don’t know what other information the partition DO would
give.

They also have two other issues:

  1. They have DO_DEVICE_INITIALIZING cleared, which means you can’t open
    them

  2. This is all changed in Vista, where the partition PDOs are created by
    the
    partition manager and not disk. So, anything you come up with will be O/S
    specific.

-scott

–
Scott Noone
Consulting Associate and Chief System Problem Analyst
OSR Open Systems Resources, Inc.
http://www.osronline.com

wrote in message news:xxxxx@ntfsd…

will \.\PhysicalDriveX not give the device object of the harddisk?
I want the device object of the partition.

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

16

>In my local world, the I: drive is my server, and is mapped to

\server5\x, but the x: drive on the server is mapped to c:\shared. So
what would it mean to “find the partition” for I:?

Nothing, so you would filter that out as part of your algorithm. It’s
trivial to differentiate these in the code.

-scott

–
Scott Noone
Consulting Associate and Chief System Problem Analyst
OSR Open Systems Resources, Inc.
http://www.osronline.com

17

I assumed that, but the OP seems to have fixated on the idea that
drive-letter == partition, and I was pointing out that this is not always
so.

The number of times I’ve had to fix code where the original programmer
assumed X == Y for some value of X and Y is fairly large. In some cases,
the programmer simply ignored the status bits that said what the thing
was, and when it wasn’t a Y, the code did something really bizarre.
joe

>In my local world, the I: drive is my server, and is mapped to
>\server5\x, but the x: drive on the server is mapped to c:\shared. So
>what would it mean to “find the partition” for I:?

Nothing, so you would filter that out as part of your algorithm. It’s
trivial to differentiate these in the code.

-scott

–
Scott Noone
Consulting Associate and Chief System Problem Analyst
OSR Open Systems Resources, Inc.
http://www.osronline.com

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

18

>the native names like \Device\HarddiskVolume1. What i need, is to map these names to a device

object of device class DiskDrive {4d36e967-e325-11ce-bfc1-08002be10318} in the device

Volumes and disks are different entities, you can only map them by using the merge algorithm between disks and volumes by the attribute of the “storage device number”, which can be queried from both sides.

Note that volume can use many disks (if it is software RAID).

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

19

> \Device\Harddisk0\DP(3)0x24ecd1e00-0x15c9406200+3

\Device\Harddisk0\DP(2)0xea609c000-0x15c8c2e000+2
\Device\Harddisk0\DP(1)0x7e00-0xea608c400+1

These names are abolished in Vista+

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com