FltGetFileNameInformation: Volume relative Path vs Full path consfusion

NTFSD
1

Hi I am using FltGetFileNameInformation in my minifilter driver.

PFLT_FILE_NAME_INFORMATION nameInfo = NULL;

// WCHAR name[MAX_NAME_SPACE / sizeof(WCHAR)];

// UNICODE_STRING defaultName;

if (pFltObjects->FileObject != NULL)

{

status = FltGetFileNameInformation(Data,

FLT_FILE_NAME_NORMALIZED,

&nameInfo);

}

I am facing a strage issue that usually the name is something like
\Device\HarddiskVolume3\SomeDir\SomeFile.txt

but sometimes it is just \My Root\SomeFile.txt.

I would be concerned about the operations done on any of the files/folders
that come under a specific folder say \Device\HarddiskVolume3\My Root

But the different formats of path obtained creates a lot of confusion

Is there any way to know when I would get volume relative path and when I
would get full Path.

-Madhu

2

> I am facing a strage issue that usually the name is something like

\Device\HarddiskVolume3\SomeDir\SomeFile.txt
but sometimes it is just \My Root\SomeFile.txt.

I have never seen this. But my suggestion would be to always call
FltParseFileNameInformation and do what it says. Maybe you are doing this
already in which case all I can say is that I have never seen this.

Is this perhaps in a pre-create case?