Hi All,
I am newbie and trying to learn file system mini filter.
To start with I am looking at mini spy code and using it as learning sample.
I understand that File Attributes and Time information is saved on file
using SET_INFORMATION FileBasicInformation.
I observed that when I make a copy of a file its original files time and
attributes are preserved on the new file.
When I open same file in Notepad, modify some content and save it, explorer
shows new modified time but I do not see any SET_INFORMATION with new time
on the file.
How is modified time on file changes without SET_INFORMATION?
I have searched the forum and checked the FAQ.
All I can find is the following FAQ
http://www.osronline.com/article.cfm?article=17#Q46
Thanks in advance!
Alex
A file system itself performs such modifications when a file is changed.
But sure this attributes can be changed by means of the
SET_INFORMATION request.
> I observed that when I make a copy of a file its original files time and
> attributes are preserved on the new file.
Because of the system sends the SET_INFORMATION request with the the
original file time after the file was copied.
–
Best regards,
Vladimir Zinin
mailto:xxxxx@eldos.com
Alex Alora wrote:
Hi All,
I am newbie and trying to learn file system mini filter.
To start with I am looking at mini spy code and using it as learning sample.
I understand that File Attributes and Time information is saved on file
using SET_INFORMATION FileBasicInformation.
I observed that when I make a copy of a file its original files time and
attributes are preserved on the new file.
When I open same file in Notepad, modify some content and save it,
explorer shows new modified time but I do not see any SET_INFORMATION
with new time on the file.
How is modified time on file changes without SET_INFORMATION?
I have searched the forum and checked the FAQ.
All I can find is the following FAQ
http://www.osronline.com/article.cfm?article=17#Q46
Thanks in advance!
Alex
Thanks for reply Vladimir!
Is there a way to know in my mini filter when File System changes modified
time?
Alex
On Dec 5, 2007 3:18 AM, Vladimir Zinin wrote:
> A file system itself performs such modifications when a file is changed.
> But sure this attributes can be changed by means of the
> SET_INFORMATION request.
>
> >
> > I observed that when I make a copy of a file its original files time
> and
> > attributes are preserved on the new file.
>
> Because of the system sends the SET_INFORMATION request with the the
> original file time after the file was copied.
>
> –
> Best regards,
> Vladimir Zinin
> mailto:xxxxx@eldos.com
>
>
> Alex Alora wrote:
> > Hi All,
> > I am newbie and trying to learn file system mini filter.
> > To start with I am looking at mini spy code and using it as learning
> sample.
> >
> > I understand that File Attributes and Time information is saved on file
> > using SET_INFORMATION FileBasicInformation.
> >
> > I observed that when I make a copy of a file its original files time and
> > attributes are preserved on the new file.
> >
> > When I open same file in Notepad, modify some content and save it,
> > explorer shows new modified time but I do not see any SET_INFORMATION
> > with new time on the file.
> >
> > How is modified time on file changes without SET_INFORMATION?
> >
> > I have searched the forum and checked the FAQ.
> > All I can find is the following FAQ
> >
> > http://www.osronline.com/article.cfm?article=17#Q46
> >
> > Thanks in advance!
> >
> > Alex
> >
> >
> >
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
Either check the requests that modify files data (nonpaged write, set
file sizes, fast io write, etc) or in IRP_MJ_CLEANUP filter check
FileObject’s flag FO_FILE_MODIFIED. Also you can check the
FILE_ATTRIBUTE_ARCHIVE bit.
For details see the routine FatUpdateDirentFromFcb from the FATFS sources.
–
Best regards,
Vladimir Zinin
mailto:xxxxx@eldos.com
Alex Alora wrote:
Thanks for reply Vladimir!
Is there a way to know in my mini filter when File System changes
modified time?
Alex
Thanks a bunch Vladimir.
Alex
On Dec 5, 2007 8:41 AM, Vladimir Zinin wrote:
> Either check the requests that modify files data (nonpaged write, set
> file sizes, fast io write, etc) or in IRP_MJ_CLEANUP filter check
> FileObject’s flag FO_FILE_MODIFIED. Also you can check the
> FILE_ATTRIBUTE_ARCHIVE bit.
> For details see the routine FatUpdateDirentFromFcb from the FATFS sources.
>
> –
> Best regards,
> Vladimir Zinin
> mailto:xxxxx@eldos.com
>
> Alex Alora wrote:
> > Thanks for reply Vladimir!
> >
> > Is there a way to know in my mini filter when File System changes
> > modified time?
> >
> >
> >
> > Alex
> >
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>