Find the whole file size to be written inside a Write IRP

NTFSD
1

Hi!

When I copy a big file, and there are many write irp’s sent with a portion of data written every time, is there any way to check the size of the whole file to be written in the beginning?

Thanks in advance!

2

NO, since you cannot be sure the writes are even for a copy.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply

wrote in message news:xxxxx@ntfsd…
> Hi!
>
> When I copy a big file, and there are many write irp’s sent with a portion
> of data written every time, is there any way to check the size of the
> whole file to be written in the beginning?
>
> Thanks in advance!
>

3

So maybe it is possible before the write irp?

4

You cannot tell a copy is happening in the kernel, this has been answer way
too many times in this newsgroup. All you will see are reads and writes.
Now if the copy utility is nice it will create the file with the allocation
size, but most copies are not nice, so the file is extended for each write.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply

wrote in message news:xxxxx@ntfsd…
> So maybe it is possible before the write irp?
>

5

Now I understand… Thank you!