Hi,
There are several backup software that work on block level. Does filter
driver will get request whenever backups are performed. What is the best way
to filter such operations?
Thanks
Ashish
> There are several backup software that work on block level. Does filter driver will get request
whenever backups are performed. What is the best way to filter such operations?
Often just CreateFile(\.\c:) is used for this. The usual DASD IO path in the FSD. Yes, filterable.
Note that you will also filter CHKDSK and FORMAT this way.
–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com
Is this related to your other thread, where you want to make “NTFS data
structures” resident?
Gary G. Little
H (952) 223-1349
C (952) 454-4629
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ashish Goyal
Sent: Wednesday, August 25, 2010 5:40 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Filtering Block Level Backup
Hi,
There are several backup software that work on block level. Does filter
driver will get request whenever backups are performed. What is the best way
to filter such operations?
Thanks
Ashish
— NTFSD is sponsored by OSR For our schedule of debugging and file system
seminars (including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars To unsubscribe, visit the List Server section of
OSR Online at http://www.osronline.com/page.cfm?name=ListServer
No Gary…
On Wed, Aug 25, 2010 at 7:47 PM, Gary G. Little wrote:
> Is this related to your other thread, where you want to make ?NTFS data
> structures? resident?
>
>
>
> Gary G. Little
>
> H (952) 223-1349
>
> C (952) 454-4629
>
> xxxxx@comcast.net
>
>
>
> From: xxxxx@lists.osr.com [mailto:
> xxxxx@lists.osr.com] *On Behalf Of *Ashish Goyal
> Sent: Wednesday, August 25, 2010 5:40 AM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] Filtering Block Level Backup
>
>
>
> Hi,
>
> There are several backup software that work on block level. Does filter
> driver will get request whenever backups are performed. What is the best way
> to filter such operations?
>
> Thanks
>
> Ashish
>
> — NTFSD is sponsored by OSR For our schedule of debugging and file system
> seminars (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars To unsubscribe, visit the List Server section
> of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
@Ash:
What kind of filter driver do you have in mind? Fs mini filter or disk filter?
@Maxin:
I had a similar question some days ago: mini filter can detect the open of a volume but how can I detect the open of a disk like “\devide\harddisk5\dr5”
Some applications are creating a image of the entire disk and are working disk block level based.
> I had a similar question some days ago: mini filter can detect the open of a volume but how can I
detect the open of a disk like “\devide\harddisk5\dr5”
This is the same as \.\PhysicalDrive5
You need to filter disk stack (not FS) in this case.
I have doubts there are such apps now, since Vista+ now fails the requests if they hit the defined partition (you still can read/write MBRs this way).
–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com
Hi,
I am talking about mini-filter…So I guess only volume open call is
received and not the file level calls.
Thanks
Ash
On Fri, Aug 27, 2010 at 5:17 AM, wrote:
> @Ash:
>
> What kind of filter driver do you have in mind? Fs mini filter or disk
> filter?
>
> @Maxin:
>
> I had a similar question some days ago: mini filter can detect the open of
> a volume but how can I detect the open of a disk like
> “\devide\harddisk5\dr5”
> Some applications are creating a image of the entire disk and are working
> disk block level based.
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
I think Netbackup 7 does block level backup…Do they bypass File System and
directly talk to Disk Stack.
On Mon, Aug 30, 2010 at 3:02 AM, Maxim S. Shatskih
wrote:
> > I had a similar question some days ago: mini filter can detect the open
> of a volume but how can I
> >detect the open of a disk like “\devide\harddisk5\dr5”
>
> This is the same as \.\PhysicalDrive5
>
> You need to filter disk stack (not FS) in this case.
>
> I have doubts there are such apps now, since Vista+ now fails the requests
> if they hit the defined partition (you still can read/write MBRs this way).
>
> –
> Maxim S. Shatskih
> Windows DDK MVP
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
My current understanding is that mini-filter only filters volumes.
To filter disks - block level read/writes - a disk filter (disk upper filter) is required (Maxim said the same).
@Maxim:
I have doubts there are such apps now, since Vista+ now fails the requests
if they hit the defined partition (you still can read/write MBRs this way).
What do you mean here?
E.g. a HexDiskEditor or ImageForWindows are still able to work block based.
Norbert
>> I have doubts there are such apps now, since Vista+ now fails the requests
> if they hit the defined partition (you still can read/write MBRs this way).
What do you mean here?
E.g. a HexDiskEditor or ImageForWindows are still able to work block based.
Yes, but they open \.\C: and not \.\PhysicalDrive0
On Vista+, the OS fails the attempts to access the sectors within the defined partition via \.\PhysicalDrive0.
Some backup products open \.\C:, then \.\D: etc sequentially (or in parallel by several worker processes) to read data, and \.\PhysicalDrive0 only to read MBR tables.
–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com
I agree these are the “normal” backup applications.
But with ImageForWindows you can backup the complete disk also incrementel.
Same is the HxD - hexeditor which can open the complete disk - by nexus.
I assume they work block based and are opening the disk (e.g \.\PhysicalDisk0 - being just a link to \device\harddiskx\DRx)
E.g. with HxD I can read/write every block on the disk - I tried it on W2K8
Norbert