How to compre two volume at the same time?

Hi,
Is there any way I can compre two NTFS volumes at the *same* time?
I try to use WinHex to do it,but every time I open a volume there’s some IRP_MJ_WRITE were sent to the volume…

> every time I open a volume there’s some IRP_MJ_WRITE were sent to the volume…

And what else would you expect??? Are you expecting Windows to suspend modified page writer only because you want to compare volumes??? Sorry, but it does not work this way. This is why checking/comparing volumes at the run time is just infeasible thing (at least as long as one of the target volumes is a bootable one, i.e. has a paging file on it)

If you don’t believe me, you can try running checkdisk utility on your system volume, and you will see that it faces exactly the same problem - you will get told that the task cannot get accomplished at the moment because someone is writing to the disk. Therefore, you will get an offer to chedule your task to be done the next time OS is booted…

Anton Bassov

Thanks,Actually, I just want to compre the two volumes to check my volume mirror driver.
So, I don’t care the modified page writer or something, I just want to compare the two volume.

> I don’t care the modified page writer or something

But you worry about IRP_MJ_WRITE, don’t you??? Look -as long as modified page writer is around,
the volume where a paging file resides is just bound to receive paging IRP_MJ_WRITE requests.

When it comes to what you call “something” (namely, mapped page writer, lazy writer thread and non-cached user IO), you can neutralize them in a filter driver simply by failing all non-RO IRP_MJ_CREATE requests to all user files on the target volume - as long as there is no way to open a single file for write access on the volume, there is just no way to write to the target volume, so that it will never receive any IRP_MJ_CREATE requests from anyone. However, you just cannot do it with a paging file(s), for understandable reasons, so that you cannot take this approach on a system volume - it is just bound to receive paging IRP_MJ_WRITE requests from modified page writer all the time, so that your comparison will always be " a bit imprecise", so to say…

Anton Bassov

Yes, Anton, you’re right.
I’m sorry I didn’t explain it clearly…The volume I monitored has no pagefile, not a system volume and the system recovery was shutdown.It’s just a simple NTFS volume.
And I compare them successfully using Vmware. But is there a way I could compare the two volume(No pagefile and not a system volume) on the real machine?
Thanks~