How to build a File backup filter driver?

NTFSD
1

Hi!
I need to build a FS filter driver that will take the backup of original contents/metadata of the file just before modification. I need to save only those bytes which will be overwritten.

In other words i need to do something of this sort:
Issue a read request for which IRP_MJ_WRITE is received, issue QueryInfo request for which IRP_MJ_SET_INFORMATION is received, etc. and save this info. somewhere…

  1. Is my approach OK?
  2. Or should i take a backup of the entire file in its IRP_MJ_CREATE??
2
  1. OK
  2. It is not so good idea. You should consider more detail for making backup
    policy.
    wrote in message news:xxxxx@ntfsd…
    > Hi!
    > I need to build a FS filter driver that will take the backup of original
    > contents/metadata of the file just before modification. I need to save
    > only those bytes which will be overwritten.
    >
    > In other words i need to do something of this sort:
    > Issue a read request for which IRP_MJ_WRITE is received, issue QueryInfo
    > request for which IRP_MJ_SET_INFORMATION is received, etc. and save this
    > info. somewhere…
    >
    > 1. Is my approach OK?
    > 2. Or should i take a backup of the entire file in its IRP_MJ_CREATE??
    >
3

Here are some other questions that i have in mind:

  1. Is a minifilter recommended or a complete FS Filter for such a software?

  2. What points should i consider for choosing one over the other (minifilter or FS filter) ?

  3. Are there any special issues that i need to consider regarding modification of files or its metadata??

4

xxxxx@yahoo.com wrote:

Here are some other questions that i have in mind:

  1. Is a minifilter recommended or a complete FS Filter for such a software?

Yes, a mini can do everything a legacy can do. It is easier too code;
highly recommended.

  1. What points should i consider for choosing one over the other (minifilter or FS filter) ?

You have a lot of reads/writes and your own creates you’ll have too do.
In a legacy filter, your going to experience re-entry using Zw routines if
you don’t roll your own IRP’s or create a shadow device. However, with a
minifilter, everything gets sent to the driver below you. From a coding
perspective, a mini is a lot easier - fewer issues to deal with.

  1. Are there any special issues that i need to consider regarding modification of files or its metadata??

Nothing that hasn’t been discussed to death in the last two weeks…
When you say ‘metadata’, if your talking about ADS, I have no idea
how to handle that in a redirection/back-up driver. I don’t believe
fltcreatefile, fltwritefile, ect. will handle that issue. I would love
to hear some comments on it - I could search the archive to answer this
for myself, but I’m busy and don’t have too deal with this issue right now.

Good luck,
m.

Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

> 1. Is a minifilter recommended or a complete FS Filter for such a software?

… n/c

  1. What points should i consider for choosing one over the other (minifilter or FS filter) ?

OS support required.

  1. Are there any special issues that i need to consider regarding modification of files or its metadata??

Yes - offline modifications.

–