I am using FltQueryDirectoryFile function in my post create callback to search for specific files within the directory. I use the instance & FileObject pointers passed in to the post create callback function for a call to FltQueryDirectoryFile. FltQueryDirectoryFile function works as expected and returns valid information.
I am also filtering PostDirectory control operation. I do not modify any data; this function just examins the status code returned by the lower FSD (NTFS). The problem I am facing now is, when ever I use FltQueryDirectoryFile in post create, the status code in PostDirectory is NO_MORE_FILES.
It looks like the NTFS FSD is storing directory search information per FileObject and restarting from where it was left before. Since I called FltQueryDirectoryFile in PostCreate to search files, it try to re-start from where it was left in subsequent DirectoryControl operations.
I tried to search files in Explorer and CMD but I do not see SL_RESTART_SCAN flag specified for any query operations.
I think I must be missing some thing. Is there any way I can undo the effects done by FltQueryDirectoryFile in postcreate.
I just want the directory control operations works as normal irrespective of whether I called FltQueryDirectoryFile in postcreate or not.
Thank you for your help,
Regards
Bala
The documentation says,
Note:
When FltQueryDirectoryFile is called multiple times on the same
directory, it is possible that the number of entries for which
information is returned will be less than expected. This is because
the set of entries to be included in the directory scan is fixed on
the first call to FltQueryDirectoryFile. In subsequent calls,
FltQueryDirectoryFile resumes the directory scan wherever it left off
in this same enumeration.
Does it mean that we can not do another directory search using the
same file object?
I mean in my first search, I specified “*.ex1” as search pattern and I
want to search for “*” again in the directory using the same file
object. As per the documentation, I understood that the second search
pattern will be ignored. This is what happening in my code.
I greatly appreciate your suggestion.
Thank you,
Regards
Bala
On 6/19/07, xxxxx@gmail.com wrote:
> I am using FltQueryDirectoryFile function in my post create callback to search for specific files within the directory. I use the instance & FileObject pointers passed in to the post create callback function for a call to FltQueryDirectoryFile. FltQueryDirectoryFile function works as expected and returns valid information.
>
> I am also filtering PostDirectory control operation. I do not modify any data; this function just examins the status code returned by the lower FSD (NTFS). The problem I am facing now is, when ever I use FltQueryDirectoryFile in post create, the status code in PostDirectory is NO_MORE_FILES.
>
> It looks like the NTFS FSD is storing directory search information per FileObject and restarting from where it was left before. Since I called FltQueryDirectoryFile in PostCreate to search files, it try to re-start from where it was left in subsequent DirectoryControl operations.
>
> I tried to search files in Explorer and CMD but I do not see SL_RESTART_SCAN flag specified for any query operations.
>
> I think I must be missing some thing. Is there any way I can undo the effects done by FltQueryDirectoryFile in postcreate.
>
> I just want the directory control operations works as normal irrespective of whether I called FltQueryDirectoryFile in postcreate or not.
>
> Thank you for your help,
>
> Regards
> Bala
>
>
>
> —
> Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
> It looks like the NTFS FSD is storing directory search information per
FileObject and restarting from where it was left before.
Exactly so. FASTFAT is also such.
–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
Thank you Maxim.
So I have to close the directory and open it again if I want to search
for different files.
Regards
Bala
On 6/19/07, Maxim S. Shatskih wrote:
> > It looks like the NTFS FSD is storing directory search information per
> >FileObject and restarting from where it was left before.
>
> Exactly so. FASTFAT is also such.
>
> –
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>
> —
> Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>