Handling surprise removal in FS Filter

OSR_Community_User · November 22, 2004, 3:48pm

Hi

I’m trying to figure what is the expected sequence of IRPs sent to the
FS filter attached to a removable HD during a removal.

I’ve got an USB drive with an NTFS volume on it connected to W2K3. When
unplugging the USB cable I expect to see (among other things)
FSCTL_DISMOUNT_VOLUME followed by FastIoDetachDevice(). However, I never
see FSCTL_DISMOUNT_VOLUME.
Instead, I get a bunch of FSCTL_INVALIDATE_VOLUMES followed by
FastIoDetachDevice().

When I plug the cable back in, the system creates a new volume device,
\Device\HarddiskVolumeX, where X keeps
incrementing after each unplug/plug exercise. This seems strange to me,
too.

I checked the IFS FAQ on the subject, which states that “there are a
number of different sequences of media removal all
centered around the FSCTL_DISMOUNT_VOLUME operation”. This not what I’ve
seen so far - in this case.

Can somebody shed a light on the subject?

Thank you in advance,

Vitaly

OSR_Community_User · November 22, 2004, 4:00pm

This sound right to me. Is there a problem with your code or are you just
asking why?

The number for the drive is monotonically incremented and there is no way to
decrement it; suppose you removed a drive in the middle like HD3 and HD 4, 5
and 6 are below it?

I think all is well and your code should be working just fine.

Jamey

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Vitaly Vatnikov
Sent: Monday, November 22, 2004 12:46 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Handling surprise removal in FS Filter

Hi

I’m trying to figure what is the expected sequence of IRPs sent to the FS
filter attached to a removable HD during a removal.

I’ve got an USB drive with an NTFS volume on it connected to W2K3. When
unplugging the USB cable I expect to see (among other things)

FSCTL_DISMOUNT_VOLUME followed by FastIoDetachDevice(). However, I never see
FSCTL_DISMOUNT_VOLUME.

Instead, I get a bunch of FSCTL_INVALIDATE_VOLUMES followed by
FastIoDetachDevice().

When I plug the cable back in, the system creates a new volume device,
\Device\HarddiskVolumeX, where X keeps

incrementing after each unplug/plug exercise. This seems strange to me, too.

I checked the IFS FAQ on the subject, which states that "there are a number
of different sequences of media removal all

centered around the FSCTL_DISMOUNT_VOLUME operation". This not what I’ve
seen so far - in this case.

Can somebody shed a light on the subject?

Thank you in advance,

Vitaly

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

OSR_Community_User · November 22, 2004, 4:38pm

Thank you for the reply.
My code assumed that for every IRP_MN_MOUNT_VOLUME there should be a
reciprocal FSCTL_DISMOUNT_VOLUME.
I thought that would be consistent: once I see mounts, shouldn’t I see
dismounts.
As far as the volume numbering, when I programatically (using
FSCTL_LOCK_VOLUME/FSCTL_DISMOUNT_VOLUME ioctl)
dismount a fixed drive, it then comes back with the same device name.
Neither of the issues is a huge deal, but it would be nice to understand
the logic behind.

Vitaly

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Jamey Kirby
Sent: Monday, November 22, 2004 3:58 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Handling surprise removal in FS Filter

This sound right to me. Is there a problem with your code or are you
just asking why?

The number for the drive is monotonically incremented and there is no
way to decrement it; suppose you removed a drive in the middle like HD3
and HD 4, 5 and 6 are below it?

I think all is well and your code should be working just fine.

Jamey

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Vitaly Vatnikov
Sent: Monday, November 22, 2004 12:46 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Handling surprise removal in FS Filter

Hi

I’m trying to figure what is the expected sequence of IRPs sent to the
FS filter attached to a removable HD during a removal.

I’ve got an USB drive with an NTFS volume on it connected to W2K3. When
unplugging the USB cable I expect to see (among other things)

FSCTL_DISMOUNT_VOLUME followed by FastIoDetachDevice(). However, I never
see FSCTL_DISMOUNT_VOLUME.

Instead, I get a bunch of FSCTL_INVALIDATE_VOLUMES followed by
FastIoDetachDevice().

When I plug the cable back in, the system creates a new volume device,
\Device\HarddiskVolumeX, where X keeps

incrementing after each unplug/plug exercise. This seems strange to me,
too.

I checked the IFS FAQ on the subject, which states that "there are a
number of different sequences of media removal all

centered around the FSCTL_DISMOUNT_VOLUME operation". This not what I’ve
seen so far - in this case.

Can somebody shed a light on the subject?

Thank you in advance,

Vitaly

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

OSR_Community_User · November 22, 2004, 4:47pm

No need to worry about dismount. Just watch for fastiodetach() and act
accordingly.

Jamey

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Vitaly Vatnikov
Sent: Monday, November 22, 2004 1:36 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Handling surprise removal in FS Filter

Thank you for the reply.

My code assumed that for every IRP_MN_MOUNT_VOLUME there should be a
reciprocal FSCTL_DISMOUNT_VOLUME.

I thought that would be consistent: once I see mounts, shouldn’t I see
dismounts.

As far as the volume numbering, when I programatically (using
FSCTL_LOCK_VOLUME/FSCTL_DISMOUNT_VOLUME ioctl)

dismount a fixed drive, it then comes back with the same device name.

Neither of the issues is a huge deal, but it would be nice to understand the
logic behind.

Vitaly