filespy code! SpyFsNotification does not call while attaching usb drive

NTFSD
1

Hi all,

I was examiming the filespy code with USB drives. I find that when I attach
the USB pen drive to the machine, SpyfsNotification(…) doesn’t get called.
If I understand correctly, this routine should get called everytime a new FS
gets mounted, or am I going wrong somewhere?

How do I detect newly attached pen drives automatically in this driver and
start logging them?

The test OS is WinXP SP2.

Regards
Rohit

2

— Rohit wrote:
> I was examiming the filespy code with USB drives. I
> find that when I attach
> the USB pen drive to the machine,
> SpyfsNotification(…) doesn’t get called.
> If I understand correctly, this routine should get
> called everytime a new FS
> gets mounted, or am I going wrong somewhere?

This function is called whenever a file system
registers or unregisters itself as an active file
system. Your wording “a new FS gets mounted” is not
semantically correct. File systems do not get mounted,
volumes get mounted.

> How do I detect newly attached pen drives
> automatically in this driver and
> start logging them?
>

Watch for mount requests in IRP_MJ_FILE_SYSTEM_CONTROL
and minor function IRP_MN_MOUNT VOLUME.

Regards,
Razvan

__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com