Find open files on a volume in mini-filter

NTFSD
1

NTFSD Folk:

I’m trying to determine the best way to find files that are open on a volume
at the time my mini-filter driver gets loaded. (Normally, the driver is
loaded at boot. But on initial driver installation and updates, the system
is up and running and files are open when the driver is loaded.)

This would happen during the instance setup.

Is there a “correct” mechanism to find open files on a volume in a
mini-filter driver?

Ken

2

Hi Ken,

From what I remember when I tried to do something like this it is “not
possible” using any documented method, if at all.

The best I managed was to use NtQuerySystemInformation with the
SystemHandleInfo class to enumerate files open by a specific process.
Much like the process explorer over at sysinternals.com.

In the end though I made the decision that if I needed to track files
that could possibly have been opened before my driver was loaded, as I
guess you need to, that I would just have to make the user reboot and
load at boot time.

I am prepared to be corrected on this one, but I think you are out of
luck

Regards

Ben Curley

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ken Cross
Sent: 28 July 2005 17:57
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Find open files on a volume in mini-filter

NTFSD Folk:

I’m trying to determine the best way to find files that are open on a
volume at the time my mini-filter driver gets loaded. (Normally, the
driver is loaded at boot. But on initial driver installation and
updates, the system is up and running and files are open when the driver
is loaded.)

This would happen during the instance setup.

Is there a “correct” mechanism to find open files on a volume in a
mini-filter driver?

Ken

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@des.co.uk To unsubscribe
send a blank email to xxxxx@lists.osr.com

3

> Is there a “correct” mechanism to find open files on a volume in a

mini-filter driver?

I think there is no simple mechanism to do this (although
I wish it was). Only file systems know about all open files
and are usually able to walk through them using internal lists,
but you as minifilter aren’t.

L.

4

Just add your contexts the first time you see an I/O for the file. You
pretty much need to have this capability anyway, due to
IoCreateStreamFileObject[Lite]. If you never see an Irp for the open file,
you shouldn’t care about it.

  • Dan.

At 12:57 PM 7/28/2005 -0400, you wrote:

NTFSD Folk:

I’m trying to determine the best way to find files that are open on a volume
at the time my mini-filter driver gets loaded. (Normally, the driver is
loaded at boot. But on initial driver installation and updates, the system
is up and running and files are open when the driver is loaded.)

This would happen during the instance setup.

Is there a “correct” mechanism to find open files on a volume in a
mini-filter driver?

Ken

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@privtek.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

Yeah, but the gotcha is that unless I add contexts to *every* file (which I
don’t now), I’d have to check every I/O on every file that doesn’t have a
context to see if it’s one I’m interested in. Yuck.

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Dan Kyler
Sent: Thursday, July 28, 2005 5:03 PM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] Find open files on a volume in mini-filter

Just add your contexts the first time you see an I/O for the file. You
pretty much need to have this capability anyway, due to
IoCreateStreamFileObject[Lite]. If you never see an Irp for the open file,
you shouldn’t care about it.

  • Dan.

At 12:57 PM 7/28/2005 -0400, you wrote:

NTFSD Folk:

I’m trying to determine the best way to find files that are open on a
volume
at the time my mini-filter driver gets loaded. (Normally, the driver is
loaded at boot. But on initial driver installation and updates, the system
is up and running and files are open when the driver is loaded.)

This would happen during the instance setup.

Is there a “correct” mechanism to find open files on a volume in a
mini-filter driver?

Ken

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@privtek.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com