Earliest time to call CreateFile (with success!)?

NTFSD
1

I have a boot driver. From this driver I want to save some data in disk as earlier as possible.
To achieve this I set a callback notification routine with IoRegisterFsRegistrationChange to be notified when NTFS is mounted.

After I receive the the notification I start calling CreateFile from time to time to create a file.

I want to create a file in the “SystemRoot” directory.

I have realized that SystemRoot symbolic link name is created in first place with the name “\Arcname…”. For example: “\Arcname\multi(0)disk(0)rdisk(0)partition(1)\windows”
Much time later it is replaced with the usual name “\Device\Harddisk0\etc”.

If I call to CreateFile when the SystemRoot symbolic link is still “\Arcname…” the function returns “PATH NOT FOUND”.
After the SystemRoot is replaced with the “\Device\Harddisk0\etc” name I am able create the file.

I have several questions:

  • Who is the creator of the symbolic link “SystemRoot” before and after the “Arcname” ?
  • Why I cannot create the file, using the “\Arcname…”, even after the mounting of the file system has taken place ?
  • Is it possible at all to access the file system using “\Arcname…” format ?

Inaki.

2

The simplest thing to do in this situation is to issue your create on the first create after the first mounted volume. This would eliminate your need to pool or mess with arc names.

Neal Christiansen
Microsoft NTFS Development Lead
This posting is provided “AS IS” with no warranties, and confers no Rights

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of I?aki Castillo
Sent: Wednesday, January 17, 2007 7:52 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Earliest time to call CreateFile (with success!)?

I have a boot driver. From this driver I want to save some data in disk as earlier as possible.
To achieve this I set a callback notification routine with IoRegisterFsRegistrationChange to be notified when NTFS is mounted.
After I receive the the notification I start calling CreateFile from time to time to create a file.
I want to create a file in the “SystemRoot” directory.
I have realized that SystemRoot symbolic link name is created in first place with the name “\Arcname…”. For example: “\Arcname\multi(0)disk(0)rdisk(0)partition(1)\windows”
Much time later it is replaced with the usual name “\Device\Harddisk0\etc”.
If I call to CreateFile when the SystemRoot symbolic link is still “\Arcname…” the function returns “PATH NOT FOUND”.
After the SystemRoot is replaced with the “\Device\Harddisk0\etc” name I am able create the file.
I have several questions:

  • Who is the creator of the symbolic link “SystemRoot” before and after the “Arcname” ?
  • Why I cannot create the file, using the “\Arcname…”, even after the mounting of the file system has taken place ?
  • Is it possible at all to access the file system using “\Arcname…” format ?

Inaki.

Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com