driver initalization sequence for volume filter driver

NTFSD
1

hello everybody

i want to know that whether the upper volume filter driver is
intialized first or the file system driver.

And if fsd driver is intialized later on . Then is their any way to
know that when it is intialized. Because i want my upper volume filter
driver to read a file present in \program files\myfolder\
directory.

And is their any method of stopping the user from accessing (i.e
reading or deleting ) this file.

thanking in advance

santosh k

2

Hello,
Volume filters are loaded and initialized before fs drivers. Fs are loaded,
initialized and mounted way after the boot, unless it’s a boot volume. If
you need to open a particular file you can force a mount operation by using
ZwCreateFile function, but it will only be useful after the fs driver has
been loaded and initialized. To know when an fs driver is loaded and
initialized you can register a notification routine using
IoRegisterFsRegistrationChange.

To protect a file from getting deleted following are the ways that I could
get from top of my head

  1. writing a fsfd and monitor the file delete request (Might be an overkill
    in your scenario)
  2. Hook syscalls. (Not at all a good method, but works. Not suggested for
    production)
  3. Keep exclusive open handles to the files. No one will be able to access
    the files. Force dismount can defeat this. This also has a side effect that
    these files cannot be defragmented. If the file sizes are large, it has an
    adverse effect on the volume defragmentation as a whole.

thanks
-Kiran

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of santosh katvate
Sent: Monday, May 02, 2005 7:14 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] driver initalization sequence for volume filter driver

hello everybody

i want to know that whether the upper volume filter driver is intialized
first or the file system driver.

And if fsd driver is intialized later on . Then is their any way to know
that when it is intialized. Because i want my upper volume filter
driver to read a file present in \program files\myfolder\
directory.

And is their any method of stopping the user from accessing (i.e reading or
deleting ) this file.

thanking in advance

santosh k

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Surely the upper filter is initialized before the FSD mounts.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “santosh katvate”
To: “Windows File Systems Devs Interest List”
Sent: Monday, May 02, 2005 5:43 PM
Subject: [ntfsd] driver initalization sequence for volume filter driver

hello everybody

i want to know that whether the upper volume filter driver is
intialized first or the file system driver.

And if fsd driver is intialized later on . Then is their any way to
know that when it is intialized. Because i want my upper volume filter
driver to read a file present in \program files\myfolder<br>directory.

And is their any method of stopping the user from accessing (i.e
reading or deleting ) this file.

thanking in advance

santosh k

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

Hello Kiran Joshi

Thanks very much for your precious help
To prevent a file from deleting or accessing i think your 3rd point is
the best one.

thanks
santosh k

On 5/2/05, Maxim S. Shatskih wrote:
> Surely the upper filter is initialized before the FSD mounts.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
> ----- Original Message -----
> From: “santosh katvate”
> To: “Windows File Systems Devs Interest List”
> Sent: Monday, May 02, 2005 5:43 PM
> Subject: [ntfsd] driver initalization sequence for volume filter driver
>
> hello everybody
>
> i want to know that whether the upper volume filter driver is
> intialized first or the file system driver.
>
> And if fsd driver is intialized later on . Then is their any way to
> know that when it is intialized. Because i want my upper volume filter
> driver to read a file present in \program files\myfolder<br>> directory.
>
> And is their any method of stopping the user from accessing (i.e
> reading or deleting ) this file.
>
> thanking in advance
>
> santosh k
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
> —
> Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

5

Hello Kiran ,Maxim

I am working on upper volume filter driver and the routine you gave
i.e IoRegisterFsRegistrationChange works for file system filter driver.

my main aim is to load a file which is placed in system volume only.

I want to read the content of the file before the first write routine
is called for any volume device objects.

So is their any suitable place where in i can call the read file routine.

thanks
santosh k.

On 5/3/05, santosh katvate wrote:
> Hello Kiran Joshi
>
> Thanks very much for your precious help
> To prevent a file from deleting or accessing i think your 3rd point is
> the best one.
>
> thanks
> santosh k
>
>
> On 5/2/05, Maxim S. Shatskih wrote:
> > Surely the upper filter is initialized before the FSD mounts.
> >
> > Maxim Shatskih, Windows DDK MVP
> > StorageCraft Corporation
> > xxxxx@storagecraft.com
> > http://www.storagecraft.com
> >
> > ----- Original Message -----
> > From: “santosh katvate”
> > To: “Windows File Systems Devs Interest List”
> > Sent: Monday, May 02, 2005 5:43 PM
> > Subject: [ntfsd] driver initalization sequence for volume filter driver
> >
> > hello everybody
> >
> > i want to know that whether the upper volume filter driver is
> > intialized first or the file system driver.
> >
> > And if fsd driver is intialized later on . Then is their any way to
> > know that when it is intialized. Because i want my upper volume filter
> > driver to read a file present in \program files\myfolder<br>> > directory.
> >
> > And is their any method of stopping the user from accessing (i.e
> > reading or deleting ) this file.
> >
> > thanking in advance
> >
> > santosh k
> >
> > —
> > Questions? First check the IFS FAQ at
> > https://www.osronline.com/article.cfm?id=17
> >
> > You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> > —
> > Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
> >
> > You are currently subscribed to ntfsd as: xxxxx@gmail.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
>

6

Hello Santosh,
Using IoRegisterFsRegistrationChange you will be able to register a
notification routine that will tell you when a file system driver is
(un)initialized. It is true that typically only FSFD’s use it, but it is not
necessary that only FSFD’s should use it. I suggested
IoRegisterFsRegistrationChange routine to you, so that you will know when
you can call ZwCreateFile to open files.

I think the only way to read a file before the first write request is sent
to a volume is when your upper volume filter driver detects and attaches to
a volume. If you wait for a fs mount, you can see writes during the mount
operations itself. So if you want to read a file before the first write
request, you should read it when you attach to the volume, of course you
*wont* be able to use ZwReadFile to accomplish this.

Thanks
-Kiran

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of santosh katvate
Sent: Tuesday, May 03, 2005 12:38 PM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] driver initalization sequence for volume filter driver

Hello Kiran ,Maxim

I am working on upper volume filter driver and the routine you gave i.e
IoRegisterFsRegistrationChange works for file system filter driver.

my main aim is to load a file which is placed in system volume only.

I want to read the content of the file before the first write routine is
called for any volume device objects.

So is their any suitable place where in i can call the read file routine.

thanks
santosh k.

On 5/3/05, santosh katvate wrote:
> Hello Kiran Joshi
>
> Thanks very much for your precious help To prevent a file from
> deleting or accessing i think your 3rd point is the best one.
>
> thanks
> santosh k
>
>
> On 5/2/05, Maxim S. Shatskih wrote:
> > Surely the upper filter is initialized before the FSD mounts.
> >
> > Maxim Shatskih, Windows DDK MVP
> > StorageCraft Corporation
> > xxxxx@storagecraft.com
> > http://www.storagecraft.com
> >
> > ----- Original Message -----
> > From: “santosh katvate”
> > To: “Windows File Systems Devs Interest List”
> > Sent: Monday, May 02, 2005 5:43 PM
> > Subject: [ntfsd] driver initalization sequence for volume filter
> > driver
> >
> > hello everybody
> >
> > i want to know that whether the upper volume filter driver is
> > intialized first or the file system driver.
> >
> > And if fsd driver is intialized later on . Then is their any way to
> > know that when it is intialized. Because i want my upper volume
> > filter driver to read a file present in \program files\myfolder\
> > directory.
> >
> > And is their any method of stopping the user from accessing (i.e
> > reading or deleting ) this file.
> >
> > thanking in advance
> >
> > santosh k
> >
> > —
> > Questions? First check the IFS FAQ at
> > https://www.osronline.com/article.cfm?id=17
> >
> > You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
> > To unsubscribe send a blank email to
> > xxxxx@lists.osr.com
> >
> > —
> > Questions? First check the IFS FAQ at
> > https://www.osronline.com/article.cfm?id=17
> >
> > You are currently subscribed to ntfsd as: xxxxx@gmail.com To
> > unsubscribe send a blank email to xxxxx@lists.osr.com
> >
>

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

7

“Volume” is a PnP class. Register your filter as a PnP UpperFilter for
Volume class, like VolSnap is registered.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “santosh katvate”
To: “Windows File Systems Devs Interest List”
Sent: Tuesday, May 03, 2005 11:08 AM
Subject: Re: [ntfsd] driver initalization sequence for volume filter driver

Hello Kiran ,Maxim

I am working on upper volume filter driver and the routine you gave
i.e IoRegisterFsRegistrationChange works for file system filter driver.

my main aim is to load a file which is placed in system volume only.

I want to read the content of the file before the first write routine
is called for any volume device objects.

So is their any suitable place where in i can call the read file routine.

thanks
santosh k.

On 5/3/05, santosh katvate wrote:
> Hello Kiran Joshi
>
> Thanks very much for your precious help
> To prevent a file from deleting or accessing i think your 3rd point is
> the best one.
>
> thanks
> santosh k
>
>
> On 5/2/05, Maxim S. Shatskih wrote:
> > Surely the upper filter is initialized before the FSD mounts.
> >
> > Maxim Shatskih, Windows DDK MVP
> > StorageCraft Corporation
> > xxxxx@storagecraft.com
> > http://www.storagecraft.com
> >
> > ----- Original Message -----
> > From: “santosh katvate”
> > To: “Windows File Systems Devs Interest List”
> > Sent: Monday, May 02, 2005 5:43 PM
> > Subject: [ntfsd] driver initalization sequence for volume filter driver
> >
> > hello everybody
> >
> > i want to know that whether the upper volume filter driver is
> > intialized first or the file system driver.
> >
> > And if fsd driver is intialized later on . Then is their any way to
> > know that when it is intialized. Because i want my upper volume filter
> > driver to read a file present in \program files\myfolder<br>> > directory.
> >
> > And is their any method of stopping the user from accessing (i.e
> > reading or deleting ) this file.
> >
> > thanking in advance
> >
> > santosh k
> >
> > —
> > Questions? First check the IFS FAQ at
> > https://www.osronline.com/article.cfm?id=17
> >
> > You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> > —
> > Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
> >
> > You are currently subscribed to ntfsd as: xxxxx@gmail.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
>

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

8

hello kiran, maxim

I want to perform volume filter driver functionality in Windows 98/Me.
how this could be done.
i know that i will have to make .vxd driver for it.

But don’t know how to attach that driver as upper volume filter driver.

i found the cdfs.vxd diskvsd.vxd etc in \windows\system\iosubsy\ directory
Is their any significance of this directory.
And if yes
how the driver in it gets loaded and attached in device tree.

Thanks
santosh k

On 5/3/05, Maxim S. Shatskih wrote:
> “Volume” is a PnP class. Register your filter as a PnP UpperFilter for
> Volume class, like VolSnap is registered.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
> ----- Original Message -----
> From: “santosh katvate”
> To: “Windows File Systems Devs Interest List”
> Sent: Tuesday, May 03, 2005 11:08 AM
> Subject: Re: [ntfsd] driver initalization sequence for volume filter driver
>
>
> Hello Kiran ,Maxim
>
> I am working on upper volume filter driver and the routine you gave
> i.e IoRegisterFsRegistrationChange works for file system filter driver.
>
> my main aim is to load a file which is placed in system volume only.
>
> I want to read the content of the file before the first write routine
> is called for any volume device objects.
>
> So is their any suitable place where in i can call the read file routine.
>
> thanks
> santosh k.
>
>
>
>
> On 5/3/05, santosh katvate wrote:
> > Hello Kiran Joshi
> >
> > Thanks very much for your precious help
> > To prevent a file from deleting or accessing i think your 3rd point is
> > the best one.
> >
> > thanks
> > santosh k
> >
> >
> > On 5/2/05, Maxim S. Shatskih wrote:
> > > Surely the upper filter is initialized before the FSD mounts.
> > >
> > > Maxim Shatskih, Windows DDK MVP
> > > StorageCraft Corporation
> > > xxxxx@storagecraft.com
> > > http://www.storagecraft.com
> > >
> > > ----- Original Message -----
> > > From: “santosh katvate”
> > > To: “Windows File Systems Devs Interest List”
> > > Sent: Monday, May 02, 2005 5:43 PM
> > > Subject: [ntfsd] driver initalization sequence for volume filter driver
> > >
> > > hello everybody
> > >
> > > i want to know that whether the upper volume filter driver is
> > > intialized first or the file system driver.
> > >
> > > And if fsd driver is intialized later on . Then is their any way to
> > > know that when it is intialized. Because i want my upper volume filter
> > > driver to read a file present in \program files\myfolder<br>> > > directory.
> > >
> > > And is their any method of stopping the user from accessing (i.e
> > > reading or deleting ) this file.
> > >
> > > thanking in advance
> > >
> > > santosh k
> > >
> > > —
> > > Questions? First check the IFS FAQ at
> > > https://www.osronline.com/article.cfm?id=17
> > >
> > > You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
> ‘’
> > > To unsubscribe send a blank email to xxxxx@lists.osr.com
> > >
> > > —
> > > Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
> > >
> > > You are currently subscribed to ntfsd as: xxxxx@gmail.com
> > > To unsubscribe send a blank email to xxxxx@lists.osr.com
> > >
> >
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

9

Why are you asking a 9x question in a NT group?

“santosh katvate” wrote in message
news:xxxxx@ntfsd…
hello kiran, maxim

I want to perform volume filter driver functionality in Windows 98/Me.
how this could be done.
i know that i will have to make .vxd driver for it.

But don’t know how to attach that driver as upper volume filter driver.

i found the cdfs.vxd diskvsd.vxd etc in \windows\system\iosubsy\ directory
Is their any significance of this directory.
And if yes
how the driver in it gets loaded and attached in device tree.

Thanks
santosh k

On 5/3/05, Maxim S. Shatskih wrote:
> “Volume” is a PnP class. Register your filter as a PnP UpperFilter for
> Volume class, like VolSnap is registered.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
> ----- Original Message -----
> From: “santosh katvate”
> To: “Windows File Systems Devs Interest List”
> Sent: Tuesday, May 03, 2005 11:08 AM
> Subject: Re: [ntfsd] driver initalization sequence for volume filter
> driver
>
>
> Hello Kiran ,Maxim
>
> I am working on upper volume filter driver and the routine you gave
> i.e IoRegisterFsRegistrationChange works for file system filter driver.
>
> my main aim is to load a file which is placed in system volume only.
>
> I want to read the content of the file before the first write routine
> is called for any volume device objects.
>
> So is their any suitable place where in i can call the read file routine.
>
> thanks
> santosh k.
>
>
>
>
> On 5/3/05, santosh katvate wrote:
> > Hello Kiran Joshi
> >
> > Thanks very much for your precious help
> > To prevent a file from deleting or accessing i think your 3rd point is
> > the best one.
> >
> > thanks
> > santosh k
> >
> >
> > On 5/2/05, Maxim S. Shatskih wrote:
> > > Surely the upper filter is initialized before the FSD mounts.
> > >
> > > Maxim Shatskih, Windows DDK MVP
> > > StorageCraft Corporation
> > > xxxxx@storagecraft.com
> > > http://www.storagecraft.com
> > >
> > > ----- Original Message -----
> > > From: “santosh katvate”
> > > To: “Windows File Systems Devs Interest List”
> > > Sent: Monday, May 02, 2005 5:43 PM
> > > Subject: [ntfsd] driver initalization sequence for volume filter
> > > driver
> > >
> > > hello everybody
> > >
> > > i want to know that whether the upper volume filter driver is
> > > intialized first or the file system driver.
> > >
> > > And if fsd driver is intialized later on . Then is their any way to
> > > know that when it is intialized. Because i want my upper volume filter
> > > driver to read a file present in \program files\myfolder<br>> > > directory.
> > >
> > > And is their any method of stopping the user from accessing (i.e
> > > reading or deleting ) this file.
> > >
> > > thanking in advance
> > >
> > > santosh k
> > >
> > > —
> > > Questions? First check the IFS FAQ at
> > > https://www.osronline.com/article.cfm?id=17
> > >
> > > You are currently subscribed to ntfsd as: unknown lmsubst tag
> > > argument:
> ‘’
> > > To unsubscribe send a blank email to xxxxx@lists.osr.com
> > >
> > > —
> > > Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
> > >
> > > You are currently subscribed to ntfsd as: xxxxx@gmail.com
> > > To unsubscribe send a blank email to xxxxx@lists.osr.com
> > >
> >
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

10

You have to completely forget most of what you learned about filtering in
NT. Get a hold of the book “Inside the Windows 95 File System” by Stan
Mitchell. It is the only worthwhile one.

Neil

----- Original Message -----

“santosh katvate” wrote in message
news:xxxxx@ntfsd…
hello kiran, maxim

I want to perform volume filter driver functionality in Windows 98/Me.
how this could be done.
i know that i will have to make .vxd driver for it.

But don’t know how to attach that driver as upper volume filter driver.

i found the cdfs.vxd diskvsd.vxd etc in \windows\system\iosubsy\ directory
Is their any significance of this directory.
And if yes
how the driver in it gets loaded and attached in device tree.

Thanks
santosh k

11

hi neil

Do you mean to say that
in windows 98/me there is no way to filter volume read/write other
than using file system filtering.

thanks for the reply

santosh k

On 5/4/05, Neil Weicher wrote:
> You have to completely forget most of what you learned about filtering in
> NT. Get a hold of the book “Inside the Windows 95 File System” by Stan
> Mitchell. It is the only worthwhile one.
>
> Neil
>
> ----- Original Message -----
>
> “santosh katvate” wrote in message
> news:xxxxx@ntfsd…
> hello kiran, maxim
>
> I want to perform volume filter driver functionality in Windows 98/Me.
> how this could be done.
> i know that i will have to make .vxd driver for it.
>
> But don’t know how to attach that driver as upper volume filter driver.
>
> i found the cdfs.vxd diskvsd.vxd etc in \windows\system\iosubsy\ directory
> Is their any significance of this directory.
> And if yes
> how the driver in it gets loaded and attached in device tree.
>
> Thanks
> santosh k
>
> —
> Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>