Filtering Non-System Files

NTFSD
1

Hi All,
I am getting a problem. Please help.
My filter driver is filtering the files of a specific drive. Now I want it
to detect the files which are always used by the OS (to prevent them from
filtering); like $MFT, pagfile.sys, $LogFile, ntuser.dat etc.
How can I do that.
Thanks
Lalit

2

For metadata files like $MFT or $LogFile you will never see IRP_MJ_CREATE,
this will allow to distinguish them. pagefile.sys is opened with a special
flag indicating that it is a paging file. But ntuser.dat is used like any
other file, I don’t know how to distingush it from other files.

“Lalit S. Rana” wrote in message
news:xxxxx@ntfsd…
>
> Hi All,
> I am getting a problem. Please help.
> My filter driver is filtering the files of a specific drive. Now I want it
> to detect the files which are always used by the OS (to prevent them from
> filtering); like $MFT, pagfile.sys, $LogFile, ntuser.dat etc.
> How can I do that.
> Thanks
> Lalit
>
>
>
>

3

to my experience there are creates for $MFT, at least. so what i do is
compile a list of system file names and exclude them from being filtered.
another not so sure way is to exclude files with the system bit.

Ampsi

----- Original Message -----
From: “Alexei Jelvis”
Newsgroups: ntfsd
To: “File Systems Developers”
Sent: Sunday, June 15, 2003 09:40
Subject: [ntfsd] Re: Filtering Non-System Files

For metadata files like $MFT or $LogFile you will never see IRP_MJ_CREATE,
this will allow to distinguish them. pagefile.sys is opened with a special
flag indicating that it is a paging file. But ntuser.dat is used like any
other file, I don’t know how to distingush it from other files.

“Lalit S. Rana” wrote in message
news:xxxxx@ntfsd…
>
> Hi All,
> I am getting a problem. Please help.
> My filter driver is filtering the files of a specific drive. Now I want it
> to detect the files which are always used by the OS (to prevent them from
> filtering); like $MFT, pagfile.sys, $LogFile, ntuser.dat etc.
> How can I do that.
> Thanks
> Lalit
>
>
>
>

—
You are currently subscribed to ntfsd as: xxxxx@pmail.ntu.edu.sg
To unsubscribe send a blank email to xxxxx@lists.osr.com