Filter driver on removable device

NTFSD
1

Hi,

I am new to filter driver.
I am trying out how to do a filter driver on a removable device.
While trying out, there is one thing i do not quite understand, when I
hook on to the IRP_MJ_WRITE function I am able to prevent a write to the
removable storage device (create a file) by completing the request with
status=STATUS_ACCESS_DENIED and Information = 0.
However if I try to delete or rename the file, Windows Explorer shows that
the file is renamed or deleted but with an error. However in actual fact
it is not renamed or deleted, because when I unplug and plug in the device
again, it shows that or when I try to create a file again, it shows the
original file again.
Do I need to do more so that it will reflect correctly that the file is
not renamed or deleted?
Or should I use DEVICE_DISK_FILE_SYSTEM instead or DEVICE_DISK?

Hope someone can enlighten me.

Thank You!

2

As a general rule, you cannot write protect mass storage devices with a
filter on the disk driver. The file systems have decided early on if
they will permit such write protection to occur. NTFS prior to XP
cannot mount a write protected volume. There is a request that occurs
early in the mount process where write protection must be answered and
cannot be changed later without a new mount occurring.

The results you are seeing is because the file system has changed the
data in the cache and your throwing away of the real writes to the media
doesn’t affect the cache.

----- Original Message -----
From: “vincent”
To: “File Systems Developers”
Sent: Friday, May 30, 2003 1:13 PM
Subject: [ntfsd] Filter driver on removable device

> Hi,
>
> I am new to filter driver.
> I am trying out how to do a filter driver on a removable device.
> While trying out, there is one thing i do not quite understand, when I
> hook on to the IRP_MJ_WRITE function I am able to prevent a write to
the
> removable storage device (create a file) by completing the request
with
> status=STATUS_ACCESS_DENIED and Information = 0.
> However if I try to delete or rename the file, Windows Explorer shows
that
> the file is renamed or deleted but with an error. However in actual
fact
> it is not renamed or deleted, because when I unplug and plug in the
device
> again, it shows that or when I try to create a file again, it shows
the
> original file again.
> Do I need to do more so that it will reflect correctly that the file
is
> not renamed or deleted?
> Or should I use DEVICE_DISK_FILE_SYSTEM instead or DEVICE_DISK?
>
> Hope someone can enlighten me.
>
> Thank You!
>
> —
> You are currently subscribed to ntfsd as: xxxxx@yoshimuni.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

3

Hi

thanks for your reply
does that mean that I have to filter on the file system driver?

thank you!

From: “David J. Craig”
>Reply-To: “File Systems Developers”
>To: “File Systems Developers”
>Subject: [ntfsd] Re: Filter driver on removable device
>Date: Fri, 30 May 2003 17:05:45 -0400
>
>As a general rule, you cannot write protect mass storage devices with a
>filter on the disk driver. The file systems have decided early on if
>they will permit such write protection to occur. NTFS prior to XP
>cannot mount a write protected volume. There is a request that occurs
>early in the mount process where write protection must be answered and
>cannot be changed later without a new mount occurring.
>
>The results you are seeing is because the file system has changed the
>data in the cache and your throwing away of the real writes to the media
>doesn’t affect the cache.
>
>----- Original Message -----
>From: “vincent”
>To: “File Systems Developers”
>Sent: Friday, May 30, 2003 1:13 PM
>Subject: [ntfsd] Filter driver on removable device
>
>
> > Hi,
> >
> > I am new to filter driver.
> > I am trying out how to do a filter driver on a removable device.
> > While trying out, there is one thing i do not quite understand, when I
> > hook on to the IRP_MJ_WRITE function I am able to prevent a write to
>the
> > removable storage device (create a file) by completing the request
>with
> > status=STATUS_ACCESS_DENIED and Information = 0.
> > However if I try to delete or rename the file, Windows Explorer shows
>that
> > the file is renamed or deleted but with an error. However in actual
>fact
> > it is not renamed or deleted, because when I unplug and plug in the
>device
> > again, it shows that or when I try to create a file again, it shows
>the
> > original file again.
> > Do I need to do more so that it will reflect correctly that the file
>is
> > not renamed or deleted?
> > Or should I use DEVICE_DISK_FILE_SYSTEM instead or DEVICE_DISK?
> >
> > Hope someone can enlighten me.
> >
> > Thank You!
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@yoshimuni.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
>
>
>
>
>—
>You are currently subscribed to ntfsd as: xxxxx@hotmail.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com

_________________________________________________________________
Take a break! Find destinations on MSN Travel. http://www.msn.com.sg/travel/

4

“vincent gambit” wrote in message
news:xxxxx@ntfsd…
>
> Hi
>
> thanks for your reply
> does that mean that I have to filter on the file system driver?
>

If you want to deny specific file system operations you need file system
filter.
If you want create read-only disk out of read-write disk you can use disk
driver filter. You need to properly inform other componets that disk is
read-only. At least you need to filter IOCTL_DISK_IS_WRITABLE and return
STATUS_MEDIA_WRITE_PROTECTED - file systems depend on it.

Alexei.

5

Hi,

Thanks for your help.
It worked.
However, there is one device which i am not able to filter under the
device_disk.
8(
its the USB floppy drive.
It seemed to me that (using devicetree) it is not under the device_disk or
device_flpydisk but device_usbstor.
Is that so?
Does it means that if i filter device_usbstor i will filter all usb
removable devices?

Thank You!

cheers,
vincent

From: “Alexei Jelvis”
>Reply-To: “File Systems Developers”
>To: “File Systems Developers”
>Subject: [ntfsd] Re: Filter driver on removable device
>Date: Fri, 30 May 2003 22:32:57 -0400
>
>“vincent gambit” wrote in message
>news:xxxxx@ntfsd…
> >
> > Hi
> >
> > thanks for your reply
> > does that mean that I have to filter on the file system driver?
> >
>
>If you want to deny specific file system operations you need file system
>filter.
>If you want create read-only disk out of read-write disk you can use disk
>driver filter. You need to properly inform other componets that disk is
>read-only. At least you need to filter IOCTL_DISK_IS_WRITABLE and return
>STATUS_MEDIA_WRITE_PROTECTED - file systems depend on it.
>
>Alexei.
>
>
>
>
>—
>You are currently subscribed to ntfsd as: xxxxx@hotmail.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com

_________________________________________________________________
Send a fun phone greeting to your friend!
http://www.msn.com.sg/mobile/fungreetings/

6

Fail CREATEs with write desired access, and not writes.

----- Original Message -----
From: “vincent”
To: “File Systems Developers”
Sent: Friday, May 30, 2003 9:13 PM
Subject: [ntfsd] Filter driver on removable device

> Hi,
>
> I am new to filter driver.
> I am trying out how to do a filter driver on a removable device.
> While trying out, there is one thing i do not quite understand, when
I
> hook on to the IRP_MJ_WRITE function I am able to prevent a write to
the
> removable storage device (create a file) by completing the request
with
> status=STATUS_ACCESS_DENIED and Information = 0.
> However if I try to delete or rename the file, Windows Explorer
shows that
> the file is renamed or deleted but with an error. However in actual
fact
> it is not renamed or deleted, because when I unplug and plug in the
device
> again, it shows that or when I try to create a file again, it shows
the
> original file again.
> Do I need to do more so that it will reflect correctly that the file
is
> not renamed or deleted?
> Or should I use DEVICE_DISK_FILE_SYSTEM instead or DEVICE_DISK?
>
> Hope someone can enlighten me.
>
> Thank You!
>
> —
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com