file name cache, renaming and filemon

NTFSD
1

hi there folks,

i was going through the filemon source code. it seems that filemon stores the name of files during irp_mj_create requests in a hash.

however it does not take into account the rename operation during IRP_MJ_SET_INFORMATION.

so, does this mean that for following operation filemon will display wrong information ?

  • create some file ( using ZwCreate )
  • rename the file ( using ZwSetInformationFile )
  • close the file ( ZwClose ) <— what will be the name of the file, shown by filemon, during this operation ? will it be name during file creation or or new name after file rename ?

Here, i assume that file is instantly renamed on succesfull completion of IRP_MJ_SET_INFORMATION. is my assumption right ?

2

Filter Manager doesn’t always return the right name after a rename
either (*it* doesn’t do this as a result of storing the wrong name, but
rather because when it asks the FSD for the name, the FSD gives it the
original name.)

So this behavior isn’t something unique to FileMon (nor is it terribly
surprising.)

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@gmail.com
Sent: Thursday, September 07, 2006 11:46 AM
To: ntfsd redirect
Subject: [ntfsd] file name cache, renaming and filemon

hi there folks,

i was going through the filemon source code. it seems that filemon
stores the name of files during irp_mj_create requests in a hash.

however it does not take into account the rename operation during
IRP_MJ_SET_INFORMATION.

so, does this mean that for following operation filemon will display
wrong information ?

  • create some file ( using ZwCreate )
  • rename the file ( using ZwSetInformationFile )
  • close the file ( ZwClose ) <— what will be the name of the file,
    shown by filemon, during this operation ? will it be name during file
    creation or or new name after file rename ?

Here, i assume that file is instantly renamed on succesfull completion
of IRP_MJ_SET_INFORMATION. is my assumption right ?

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

“So this behavior isn’t something unique to FileMon (nor is it terribly surprising.)”

thanks tony. it was just plain curiousity …thats all. :smiley:

4

My experience is, that it helps (e.g. in design) to consider file names
as file *decoration* that can change and rely on FS file ID or object ID
for file identification. Note that not all FS provides reliable File ID
functionality (e.g NTFS does, FAT does not).
WBR Primoz

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Tony Mason
Sent: 7. september 2006 21:49
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] file name cache, renaming and filemon

Filter Manager doesn’t always return the right name after a rename
either (*it* doesn’t do this as a result of storing the wrong name, but
rather because when it asks the FSD for the name, the FSD gives it the
original name.)

So this behavior isn’t something unique to FileMon (nor is it terribly
surprising.)

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@gmail.com
Sent: Thursday, September 07, 2006 11:46 AM
To: ntfsd redirect
Subject: [ntfsd] file name cache, renaming and filemon

hi there folks,

i was going through the filemon source code. it seems that filemon
stores the name of files during irp_mj_create requests in a hash.

however it does not take into account the rename operation during
IRP_MJ_SET_INFORMATION.

so, does this mean that for following operation filemon will display
wrong information ?

  • create some file ( using ZwCreate )
  • rename the file ( using ZwSetInformationFile )
  • close the file ( ZwClose ) <— what will be the name of the file,
    shown by filemon, during this operation ? will it be name during file
    creation or or new name after file rename ?

Here, i assume that file is instantly renamed on succesfull completion
of IRP_MJ_SET_INFORMATION. is my assumption right ?

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com