FS mini filter - Detect change in file to recalculate SHA256 hash?

NTFSD
1

Hi,

I'm calculating SHA-256 using CNG API in Mini filter driver. Now I'm planning to implement a cache for existing file-hash combination and avoid next time if there is no change in the file.

I'm looking for unique attribute which will find out is there any change in file contents. It seems LastWriteTime is not reliable, and I can register for pre and post operations to detect either write or change in size of file. It seems bit overhead.

Is there any alternative where I can detect there is a change in content or size of file, so that either pick the hash from cache or invalidate and recalculation hash.

Thanks,
Suresh

2

Hi. You can:

  1. store hash in Kernel EAs "$Kernel.Purge." in Windows 8+ on NTFS (I'm not sure about ReFS)
  2. store hash in FLT_STREAM_CONTEXT and implement your own logic with tracking of all changes (IRP_MJ_WRITE, IOCTLs and FSCTLs, etc.)