formatting a drive

NTFSD
2

> Can any one tell me which all IRP types I need to tap to

effectively diasble a disk format/ partition format?

If you need just this, you may write a small “Hello-World”
app which will create a dummy file and keeps it open
through the whole Windows session. An open file causes
that the volume cannot be locked and thus
cannot be formatted.

If you need to make that application unkillable,
write it as service.

A flow of the format pocess (for windows), would help.

The best is that you’ll get the FileSpy tool from osronline.com
and watch it yourself.

Does the windows format process, differ from the format.exe
supplied by windows as a command line utility?

Maybe, but the volume must be locked in every case.

Do the calls for the command line format go through the same drier stack?

Certainly. The drive is handled by one FS driver for all apps.

L.

3

IRP_MJ_WRITE

Block that and you’ll disable a disk format or partition update.

All a disk format is is an initialisation of the file system, new
meta-data is written to the disk. The low-level process of writing
that meta-data is not distinguishable from any other form of disk access.

Re-think what you want to achieve, or what your manager has asked you.

Mark

At 07:20 AM 7/28/2005, Amitrajit Banerjee. wrote:

hi all,

Can any one tell me which all IRP types I need to tap to effectively
diasble a disk format/ partition format?

A flow of the format pocess (for windows), would help.

Does the windows format process, differ from the format.exe supplied
by windows as a command line utility?

Do the calls for the command line format go through the same drier stack?

amitr0
Note:-

  1. Spelling Mistakes and Grammatical Errors, If Any, Are Regretted.
  2. Kindly Acknowledge This Mail At The Earliest.
  3. This E-Mail Might contain Confidential information. If You Are Not Entitled
    To View it, Please Delete The Message Immediately And Inform Me.
    Thanking You,
    Amitrajit Banerjee.
4

There is no exact answer to this question. You can see flow of format in filter for FSD, one of the IOCTLs commonly sended during format by standard format routine is FSCTL_ALLOW_EXTENDED_DASD_IO.

“Amitrajit Banerjee.” wrote in message news:xxxxx@ntfsd…

hi all,

Can any one tell me which all IRP types I need to tap to effectively diasble a disk format/ partition format?

A flow of the format pocess (for windows), would help.

Does the windows format process, differ from the format.exe supplied by windows as a command line utility?

Do the calls for the command line format go through the same drier stack?

amitr0

Note:-
1) Spelling Mistakes and Grammatical Errors, If Any, Are Regretted.
2) Kindly Acknowledge This Mail At The Earliest.
3) This E-Mail Might contain Confidential information. If You Are Not Entitled
To View it, Please Delete The Message Immediately And Inform Me.
Thanking You,
Amitrajit Banerjee.

5

The fix the PFN related bug instead of disabling format.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: Amitrajit Banerjee.
To: Windows File Systems Devs Interest List
Sent: Thursday, July 28, 2005 11:35 AM
Subject: Re: Re: [ntfsd] formatting a drive

Dear Mark, and Laislov,

Thanks for all the suggestions. Yes Mark, I have tapped IRP_MJ_WRITE, however, what I intend to do is a bit more complex from simple format disabling.

I intend to write a sector lever disk encryption driver that is capable of encrypting/decrypting a partition of any HDD.

Well, the problem is that, I have the starting sector of my test partition and the length of the same. Thus I can tune IRP_MJ_WRITE to encrypt all data that does to these sectors.

However, when I try to format the partition with the driver running, I get a PFN crash!!!

I find using filespy (excellent tool, thanks Laislov), tht apart from IRP_MJ_READ and write the format comand also issues device query irps.

My doubt is, do these IRPs actually bypass the READ irp and get the information abt the disk (from the boot sector), if so then my decryption routine needs handle them too.

I would be glad if you can help. Though, I know the PRN crash is mostly due to stray pointers, or incorrect MDL handling, I don’t think that is the cause here, if it was, I would not be able to use the drierr at all.

Regards,

amitr0

On Thu, 28 Jul 2005 Mark S.Edwards wrote :
>IRP_MJ_WRITE
>
>Block that and you’ll disable a disk format or partition update.
>
>
>All a disk format is is an initialisation of the file system, new
>meta-data is written to the disk. The low-level process of writing
>that meta-data is not distinguishable from any other form of disk access.
>
>Re-think what you want to achieve, or what your manager has asked you.
>
>Mark
>
>At 07:20 AM 7/28/2005, Amitrajit Banerjee. wrote:
>
>>
>>hi all,
>>
>>Can any one tell me which all IRP types I need to tap to effectively
>>diasble a disk format/ partition format?
>>
>>A flow of the format pocess (for windows), would help.
>>
>>Does the windows format process, differ from the format.exe supplied
>>by windows as a command line utility?
>>
>>Do the calls for the command line format go through the same drier stack?
>>
>>amitr0
>>Note:-
>>1) Spelling Mistakes and Grammatical Errors, If Any, Are Regretted.
>>2) Kindly Acknowledge This Mail At The Earliest.
>>3) This E-Mail Might contain Confidential information. If You Are Not Entitled
>>To View it, Please Delete The Message Immediately And Inform Me.
>>Thanking You,
>>Amitrajit Banerjee.
>
>
>
>—
>Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: xxxxx@rediffmail.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com

Note:-

  1. Spelling Mistakes and Grammatical Errors, If Any, Are Regretted.
  2. Kindly Acknowledge This Mail At The Earliest.
  3. This E-Mail Might contain Confidential information. If You Are Not Entitled
    To View it, Please Delete The Message Immediately And Inform Me.
    Thanking You,
    Amitrajit Banerjee.

— Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17 You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’ To unsubscribe send a blank email to xxxxx@lists.osr.com