OK, here’s the situation. I’m installing hooks on NTFS. I first get
PDEVICE_OBJECT for ‘\Ntfs’ device. Then enumerate all devices created by
‘\Ntfs’ (one device created for every NTFS volume) and install filter
device for each of them. Everything is fine except for I cannot get drive
letter.
P.S. This all is a little bit messy but if you want the situation described
better - I can do that.
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
Under Win2K you can retrieve drive letter using IOCTL_MOUNTMGR_QUERY_POINTS.
Regards,
Dennis.
----- Original Message -----
From: “Alexey Logachyov”
To: “NT Developers Interest List”
Sent: Friday, September 28, 2001 1:12 AM
Subject: [ntdev] how to get drive letter (or volume name)
> OK, here’s the situation. I’m installing hooks on NTFS. I first get
> PDEVICE_OBJECT for ‘\Ntfs’ device. Then enumerate all devices created by
> ‘\Ntfs’ (one device created for every NTFS volume) and install filter
> device for each of them. Everything is fine except for I cannot get drive
> letter.
>
> P.S. This all is a little bit messy but if you want the situation
described
> better - I can do that.
>
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@acronis.ru
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
What about NT4? And another question - who is mount manager. I heared
several times about it but what is its driver name and what devices does it
create?
Anyway, thank you for reply.
P.S. Oh, yes. What are the parameters for IOCTL_MOUNTMGR_QUERY_POINTS?
----- Original Message -----
From: “Dennis S. Dyatlov”
To: “NT Developers Interest List”
Sent: Friday, September 28, 2001 8:39
Subject: [ntdev] Re: how to get drive letter (or volume name)
> Under Win2K you can retrieve drive letter using
IOCTL_MOUNTMGR_QUERY_POINTS.
>
> Regards,
> Dennis.
>
> ----- Original Message -----
> From: “Alexey Logachyov”
> To: “NT Developers Interest List”
> Sent: Friday, September 28, 2001 1:12 AM
> Subject: [ntdev] how to get drive letter (or volume name)
>
>
> > OK, here’s the situation. I’m installing hooks on NTFS. I first get
> > PDEVICE_OBJECT for ‘\Ntfs’ device. Then enumerate all devices created
by
> > ‘\Ntfs’ (one device created for every NTFS volume) and install filter
> > device for each of them. Everything is fine except for I cannot get
drive
> > letter.
> >
> > P.S. This all is a little bit messy but if you want the situation
> described
> > better - I can do that.
> >
> >
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@acronis.ru
> > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> >
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
Under NT4 try look for all letters and retrieve device stack for
corresponding symbolic link using IoGetDeviceObjectPointer then check that
your filter DO belongs to the retrieved stack.
Look at DDK for IOCTL_MOUNTMGR_QUERY_POINTS parameters.
Regards,
Dennis.
----- Original Message -----
From: “Alexey Logachyov”
To: “NT Developers Interest List”
Sent: Friday, September 28, 2001 5:15 PM
Subject: [ntdev] Re: how to get drive letter (or volume name)
> What about NT4? And another question - who is mount manager. I heared
> several times about it but what is its driver name and what devices does
it
> create?
>
> Anyway, thank you for reply.
>
> P.S. Oh, yes. What are the parameters for IOCTL_MOUNTMGR_QUERY_POINTS?
>
> ----- Original Message -----
> From: “Dennis S. Dyatlov”
> To: “NT Developers Interest List”
> Sent: Friday, September 28, 2001 8:39
> Subject: [ntdev] Re: how to get drive letter (or volume name)
>
>
> > Under Win2K you can retrieve drive letter using
> IOCTL_MOUNTMGR_QUERY_POINTS.
> >
> > Regards,
> > Dennis.
> >
> > ----- Original Message -----
> > From: “Alexey Logachyov”
> > To: “NT Developers Interest List”
> > Sent: Friday, September 28, 2001 1:12 AM
> > Subject: [ntdev] how to get drive letter (or volume name)
> >
> >
> > > OK, here’s the situation. I’m installing hooks on NTFS. I first get
> > > PDEVICE_OBJECT for ‘\Ntfs’ device. Then enumerate all devices created
> by
> > > ‘\Ntfs’ (one device created for every NTFS volume) and install filter
> > > device for each of them. Everything is fine except for I cannot get
> drive
> > > letter.
> > >
> > > P.S. This all is a little bit messy but if you want the situation
> > described
> > > better - I can do that.
> > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntdev as: xxxxx@acronis.ru
> > > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> > >
> >
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@vba.com.by
> > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@acronis.ru
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
Or simply setup a private IOCtl in your filter that a user app calls down
each stack with the drive letter. You intercept this IOCtl and, voila, you
have the drive letter for the stack you are sitting in.
Pete
Peter Scott
xxxxx@KernelDrivers.com
http://www.KernelDrivers.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Dennis S. Dyatlov
Sent: Friday, September 28, 2001 7:40 AM
To: NT Developers Interest List
Subject: [ntdev] Re: how to get drive letter (or volume name)
Under NT4 try look for all letters and retrieve device stack for
corresponding symbolic link using IoGetDeviceObjectPointer then check that
your filter DO belongs to the retrieved stack.
Look at DDK for IOCTL_MOUNTMGR_QUERY_POINTS parameters.
Regards,
Dennis.
----- Original Message -----
From: “Alexey Logachyov”
To: “NT Developers Interest List”
Sent: Friday, September 28, 2001 5:15 PM
Subject: [ntdev] Re: how to get drive letter (or volume name)
> What about NT4? And another question - who is mount manager. I heared
> several times about it but what is its driver name and what devices does
it
> create?
>
> Anyway, thank you for reply.
>
> P.S. Oh, yes. What are the parameters for IOCTL_MOUNTMGR_QUERY_POINTS?
>
> ----- Original Message -----
> From: “Dennis S. Dyatlov”
> To: “NT Developers Interest List”
> Sent: Friday, September 28, 2001 8:39
> Subject: [ntdev] Re: how to get drive letter (or volume name)
>
>
> > Under Win2K you can retrieve drive letter using
> IOCTL_MOUNTMGR_QUERY_POINTS.
> >
> > Regards,
> > Dennis.
> >
> > ----- Original Message -----
> > From: “Alexey Logachyov”
> > To: “NT Developers Interest List”
> > Sent: Friday, September 28, 2001 1:12 AM
> > Subject: [ntdev] how to get drive letter (or volume name)
> >
> >
> > > OK, here’s the situation. I’m installing hooks on NTFS. I first get
> > > PDEVICE_OBJECT for ‘\Ntfs’ device. Then enumerate all devices created
> by
> > > ‘\Ntfs’ (one device created for every NTFS volume) and install filter
> > > device for each of them. Everything is fine except for I cannot get
> drive
> > > letter.
> > >
> > > P.S. This all is a little bit messy but if you want the situation
> > described
> > > better - I can do that.
> > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntdev as: xxxxx@acronis.ru
> > > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> > >
> >
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@vba.com.by
> > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@acronis.ru
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
—
You are currently subscribed to ntdev as: xxxxx@home.com
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> OK, here’s the situation. I’m installing hooks on NTFS. I first get
PDEVICE_OBJECT for ‘\Ntfs’ device. Then enumerate all devices created by
‘\Ntfs’ (one device created for every NTFS volume)
Wrong. You must a) filter the FS registration changes b) add a filter over any FS’s control device object c) filter mount requests
d) add a filter to the FS’s volume device object just after successful mount.
See SFILTER sample for details - though it seems to have some bug in mount path.
Max
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
MountMgr is a kernel-mode piece of code which assigns symlinks like \.\D: to the disk stacks.
It maintains a database of volume GUID -> drive letter mappings to do this.
Max
----- Original Message -----
From: “Alexey Logachyov”
To: “NT Developers Interest List”
Sent: Friday, September 28, 2001 5:15 PM
Subject: [ntdev] Re: how to get drive letter (or volume name)
> What about NT4? And another question - who is mount manager. I heared
> several times about it but what is its driver name and what devices does it
> create?
>
> Anyway, thank you for reply.
>
> P.S. Oh, yes. What are the parameters for IOCTL_MOUNTMGR_QUERY_POINTS?
>
> ----- Original Message -----
> From: “Dennis S. Dyatlov”
> To: “NT Developers Interest List”
> Sent: Friday, September 28, 2001 8:39
> Subject: [ntdev] Re: how to get drive letter (or volume name)
>
>
> > Under Win2K you can retrieve drive letter using
> IOCTL_MOUNTMGR_QUERY_POINTS.
> >
> > Regards,
> > Dennis.
> >
> > ----- Original Message -----
> > From: “Alexey Logachyov”
> > To: “NT Developers Interest List”
> > Sent: Friday, September 28, 2001 1:12 AM
> > Subject: [ntdev] how to get drive letter (or volume name)
> >
> >
> > > OK, here’s the situation. I’m installing hooks on NTFS. I first get
> > > PDEVICE_OBJECT for ‘\Ntfs’ device. Then enumerate all devices created
> by
> > > ‘\Ntfs’ (one device created for every NTFS volume) and install filter
> > > device for each of them. Everything is fine except for I cannot get
> drive
> > > letter.
> > >
> > > P.S. This all is a little bit messy but if you want the situation
> > described
> > > better - I can do that.
> > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntdev as: xxxxx@acronis.ru
> > > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> > >
> >
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@vba.com.by
> > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
I already tried to look for all letters. But I don’t like that when I’m
trying to get device object for a: my floppy issues noise. Another thing -
sometimes drives do not have a drive letter.So, I need a name like
HarddiskVolumeX.
What kind of DDK you are talking about? Is that IFS Kit? I didn’t find any
mentioning of IOCTL_MOUNTMGR_xxx in Win2k DDK and I don’t have IFS Kit.
? ?? ? ??? ??? ??? IFS Kit, ?? ??? - ??? ???, ?
? ??? ??? ??? ??? ?? ???. ??? ? ??? ??? ???
???.
----- Original Message -----
From: “Dennis S. Dyatlov”
To: “NT Developers Interest List”
Sent: Friday, September 28, 2001 16:40
Subject: [ntdev] Re: how to get drive letter (or volume name)
> Under NT4 try look for all letters and retrieve device stack for
> corresponding symbolic link using IoGetDeviceObjectPointer then check that
> your filter DO belongs to the retrieved stack.
> Look at DDK for IOCTL_MOUNTMGR_QUERY_POINTS parameters.
>
> Regards,
> Dennis.
>
> ----- Original Message -----
> From: “Alexey Logachyov”
> To: “NT Developers Interest List”
> Sent: Friday, September 28, 2001 5:15 PM
> Subject: [ntdev] Re: how to get drive letter (or volume name)
>
>
> > What about NT4? And another question - who is mount manager. I heared
> > several times about it but what is its driver name and what devices does
> it
> > create?
> >
> > Anyway, thank you for reply.
> >
> > P.S. Oh, yes. What are the parameters for IOCTL_MOUNTMGR_QUERY_POINTS?
> >
> > ----- Original Message -----
> > From: “Dennis S. Dyatlov”
> > To: “NT Developers Interest List”
> > Sent: Friday, September 28, 2001 8:39
> > Subject: [ntdev] Re: how to get drive letter (or volume name)
> >
> >
> > > Under Win2K you can retrieve drive letter using
> > IOCTL_MOUNTMGR_QUERY_POINTS.
> > >
> > > Regards,
> > > Dennis.
> > >
> > > ----- Original Message -----
> > > From: “Alexey Logachyov”
> > > To: “NT Developers Interest List”
> > > Sent: Friday, September 28, 2001 1:12 AM
> > > Subject: [ntdev] how to get drive letter (or volume name)
> > >
> > >
> > > > OK, here’s the situation. I’m installing hooks on NTFS. I first get
> > > > PDEVICE_OBJECT for ‘\Ntfs’ device. Then enumerate all devices
created
> > by
> > > > ‘\Ntfs’ (one device created for every NTFS volume) and install
filter
> > > > device for each of them. Everything is fine except for I cannot get
> > drive
> > > > letter.
> > > >
> > > > P.S. This all is a little bit messy but if you want the situation
> > > described
> > > > better - I can do that.
> > > >
> > > >
> > > >
> > > > —
> > > > You are currently subscribed to ntdev as: xxxxx@acronis.ru
> > > > To unsubscribe send a blank email to xxxxx@lists.osr.com
> > > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntdev as: xxxxx@vba.com.by
> > > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@acronis.ru
> > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> >
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
Wait, wait, wait. Could you explain this better?
----- Original Message -----
From: “Pete Scott”
To: “NT Developers Interest List”
Sent: Friday, September 28, 2001 16:46
Subject: [ntdev] Re: how to get drive letter (or volume name)
>
> Or simply setup a private IOCtl in your filter that a user app calls down
> each stack with the drive letter. You intercept this IOCtl and, voila, you
> have the drive letter for the stack you are sitting in.
>
> Pete
>
> Peter Scott
> xxxxx@KernelDrivers.com
> http://www.KernelDrivers.com
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com]On Behalf Of Dennis S. Dyatlov
> Sent: Friday, September 28, 2001 7:40 AM
> To: NT Developers Interest List
> Subject: [ntdev] Re: how to get drive letter (or volume name)
>
>
> Under NT4 try look for all letters and retrieve device stack for
> corresponding symbolic link using IoGetDeviceObjectPointer then check that
> your filter DO belongs to the retrieved stack.
> Look at DDK for IOCTL_MOUNTMGR_QUERY_POINTS parameters.
>
> Regards,
> Dennis.
>
> ----- Original Message -----
> From: “Alexey Logachyov”
> To: “NT Developers Interest List”
> Sent: Friday, September 28, 2001 5:15 PM
> Subject: [ntdev] Re: how to get drive letter (or volume name)
>
>
> > What about NT4? And another question - who is mount manager. I heared
> > several times about it but what is its driver name and what devices does
> it
> > create?
> >
> > Anyway, thank you for reply.
> >
> > P.S. Oh, yes. What are the parameters for IOCTL_MOUNTMGR_QUERY_POINTS?
> >
> > ----- Original Message -----
> > From: “Dennis S. Dyatlov”
> > To: “NT Developers Interest List”
> > Sent: Friday, September 28, 2001 8:39
> > Subject: [ntdev] Re: how to get drive letter (or volume name)
> >
> >
> > > Under Win2K you can retrieve drive letter using
> > IOCTL_MOUNTMGR_QUERY_POINTS.
> > >
> > > Regards,
> > > Dennis.
> > >
> > > ----- Original Message -----
> > > From: “Alexey Logachyov”
> > > To: “NT Developers Interest List”
> > > Sent: Friday, September 28, 2001 1:12 AM
> > > Subject: [ntdev] how to get drive letter (or volume name)
> > >
> > >
> > > > OK, here’s the situation. I’m installing hooks on NTFS. I first get
> > > > PDEVICE_OBJECT for ‘\Ntfs’ device. Then enumerate all devices
created
> > by
> > > > ‘\Ntfs’ (one device created for every NTFS volume) and install
filter
> > > > device for each of them. Everything is fine except for I cannot get
> > drive
> > > > letter.
> > > >
> > > > P.S. This all is a little bit messy but if you want the situation
> > > described
> > > > better - I can do that.
> > > >
> > > >
> > > >
> > > > —
> > > > You are currently subscribed to ntdev as: xxxxx@acronis.ru
> > > > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> > > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntdev as: xxxxx@vba.com.by
> > > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> >
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@acronis.ru
> > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> >
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@home.com
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
That’s great but my driver is not loaded during Windows startup. So I would
probably miss all of FS registration changes. I know that I will have to
that anyway to watch mount changes.
Could you send me sfilter sources? I heared about it several times but I
don’t have it.
----- Original Message -----
From: “Maxim S. Shatskih”
To: “NT Developers Interest List”
Sent: Friday, September 28, 2001 19:58
Subject: [ntdev] Re: how to get drive letter (or volume name)
> > OK, here’s the situation. I’m installing hooks on NTFS. I first get
> > PDEVICE_OBJECT for ‘\Ntfs’ device. Then enumerate all devices created
by
> > ‘\Ntfs’ (one device created for every NTFS volume)
>
> Wrong. You must a) filter the FS registration changes b) add a filter over
any FS’s control device object c) filter mount requests
> d) add a filter to the FS’s volume device object just after successful
mount.
> See SFILTER sample for details - though it seems to have some bug in mount
path.
>
> Max
>
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
Yes, I fount mount manager header file in win2k ddk but it is not
documented.
----- Original Message -----
From: “Maxim S. Shatskih”
To: “NT Developers Interest List”
Sent: Friday, September 28, 2001 20:25
Subject: [ntdev] Re: how to get drive letter (or volume name)
> MountMgr is a kernel-mode piece of code which assigns symlinks like \.\D:
to the disk stacks.
> It maintains a database of volume GUID -> drive letter mappings to do
this.
>
> Max
>
> ----- Original Message -----
> From: “Alexey Logachyov”
> To: “NT Developers Interest List”
> Sent: Friday, September 28, 2001 5:15 PM
> Subject: [ntdev] Re: how to get drive letter (or volume name)
>
>
> > What about NT4? And another question - who is mount manager. I heared
> > several times about it but what is its driver name and what devices does
it
> > create?
> >
> > Anyway, thank you for reply.
> >
> > P.S. Oh, yes. What are the parameters for IOCTL_MOUNTMGR_QUERY_POINTS?
> >
> > ----- Original Message -----
> > From: “Dennis S. Dyatlov”
> > To: “NT Developers Interest List”
> > Sent: Friday, September 28, 2001 8:39
> > Subject: [ntdev] Re: how to get drive letter (or volume name)
> >
> >
> > > Under Win2K you can retrieve drive letter using
> > IOCTL_MOUNTMGR_QUERY_POINTS.
> > >
> > > Regards,
> > > Dennis.
> > >
> > > ----- Original Message -----
> > > From: “Alexey Logachyov”
> > > To: “NT Developers Interest List”
> > > Sent: Friday, September 28, 2001 1:12 AM
> > > Subject: [ntdev] how to get drive letter (or volume name)
> > >
> > >
> > > > OK, here’s the situation. I’m installing hooks on NTFS. I first get
> > > > PDEVICE_OBJECT for ‘\Ntfs’ device. Then enumerate all devices
created
> > by
> > > > ‘\Ntfs’ (one device created for every NTFS volume) and install
filter
> > > > device for each of them. Everything is fine except for I cannot get
> > drive
> > > > letter.
> > > >
> > > > P.S. This all is a little bit messy but if you want the situation
> > > described
> > > > better - I can do that.
> > > >
> > > >
> > > >
> > > > —
> > > > You are currently subscribed to ntdev as: xxxxx@acronis.ru
> > > > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> > > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntdev as: xxxxx@vba.com.by
> > > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> >
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> >
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
Alexey,
You need to give BillG some money and get the IFS kit. See the DDK page
at microsoft, its listed there. It isn’t too terribly expensive.
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Alexey Logachyov
Sent: Saturday, September 29, 2001 6:19 PM
To: NT Developers Interest List
Subject: [ntdev] Re: how to get drive letter (or volume name)
That’s great but my driver is not loaded during Windows
startup. So I would probably miss all of FS registration
changes. I know that I will have to that anyway to watch
mount changes.
Could you send me sfilter sources? I heared about it several
times but I don’t have it.
----- Original Message -----
From: “Maxim S. Shatskih”
> To: “NT Developers Interest List”
> Sent: Friday, September 28, 2001 19:58
> Subject: [ntdev] Re: how to get drive letter (or volume name)
>
>
> > > OK, here’s the situation. I’m installing hooks on NTFS. I
> first get
> > > PDEVICE_OBJECT for ‘\Ntfs’ device. Then enumerate all devices
> > > created
> by
> > > ‘\Ntfs’ (one device created for every NTFS volume)
> >
> > Wrong. You must a) filter the FS registration changes b)
> add a filter
> > over
> any FS’s control device object c) filter mount requests
> > d) add a filter to the FS’s volume device object just after
> successful
> mount.
> > See SFILTER sample for details - though it seems to have
> some bug in
> > mount
> path.
> >
> > Max
> >
> >
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@vba.com.by
> > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
> —
> You are currently subscribed to ntdev as:
> xxxxx@hollistech.com To unsubscribe send a blank email to
> leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
Look guys. I mean you, Max, and Dennis. Seems like you are more competent in
the question than I am. Could you tell me if I’m doing everything wrong? I
work in an antivirus company. I have to write a driver that intercepts all
the file open, write, close, and rename operations. May be I started with a
wrong way?
----- Original Message -----
From: “Maxim S. Shatskih”
To: “NT Developers Interest List”
Sent: Friday, September 28, 2001 20:25
Subject: [ntdev] Re: how to get drive letter (or volume name)
> MountMgr is a kernel-mode piece of code which assigns symlinks like \.\D:
to the disk stacks.
> It maintains a database of volume GUID -> drive letter mappings to do
this.
>
> Max
>
> ----- Original Message -----
> From: “Alexey Logachyov”
> To: “NT Developers Interest List”
> Sent: Friday, September 28, 2001 5:15 PM
> Subject: [ntdev] Re: how to get drive letter (or volume name)
>
>
> > What about NT4? And another question - who is mount manager. I heared
> > several times about it but what is its driver name and what devices does
it
> > create?
> >
> > Anyway, thank you for reply.
> >
> > P.S. Oh, yes. What are the parameters for IOCTL_MOUNTMGR_QUERY_POINTS?
> >
> > ----- Original Message -----
> > From: “Dennis S. Dyatlov”
> > To: “NT Developers Interest List”
> > Sent: Friday, September 28, 2001 8:39
> > Subject: [ntdev] Re: how to get drive letter (or volume name)
> >
> >
> > > Under Win2K you can retrieve drive letter using
> > IOCTL_MOUNTMGR_QUERY_POINTS.
> > >
> > > Regards,
> > > Dennis.
> > >
> > > ----- Original Message -----
> > > From: “Alexey Logachyov”
> > > To: “NT Developers Interest List”
> > > Sent: Friday, September 28, 2001 1:12 AM
> > > Subject: [ntdev] how to get drive letter (or volume name)
> > >
> > >
> > > > OK, here’s the situation. I’m installing hooks on NTFS. I first get
> > > > PDEVICE_OBJECT for ‘\Ntfs’ device. Then enumerate all devices
created
> > by
> > > > ‘\Ntfs’ (one device created for every NTFS volume) and install
filter
> > > > device for each of them. Everything is fine except for I cannot get
> > drive
> > > > letter.
> > > >
> > > > P.S. This all is a little bit messy but if you want the situation
> > > described
> > > > better - I can do that.
> > > >
> > > >
> > > >
> > > > —
> > > > You are currently subscribed to ntdev as: xxxxx@acronis.ru
> > > > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> > > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntdev as: xxxxx@vba.com.by
> > > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> >
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> >
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
Filesystem filters must be loaded at boot before even the SystemRoot volume mounts.
Otherwise, they will not be able to filter any volumes mounted before the filter loaded.
Max
----- Original Message -----
From: “Alexey Logachyov”
To: “NT Developers Interest List”
Sent: Sunday, September 30, 2001 2:19 AM
Subject: [ntdev] Re: how to get drive letter (or volume name)
> That’s great but my driver is not loaded during Windows startup. So I would
> probably miss all of FS registration changes. I know that I will have to
> that anyway to watch mount changes.
>
> Could you send me sfilter sources? I heared about it several times but I
> don’t have it.
>
> ----- Original Message -----
> From: “Maxim S. Shatskih”
> To: “NT Developers Interest List”
> Sent: Friday, September 28, 2001 19:58
> Subject: [ntdev] Re: how to get drive letter (or volume name)
>
>
> > > OK, here’s the situation. I’m installing hooks on NTFS. I first get
> > > PDEVICE_OBJECT for ‘\Ntfs’ device. Then enumerate all devices created
> by
> > > ‘\Ntfs’ (one device created for every NTFS volume)
> >
> > Wrong. You must a) filter the FS registration changes b) add a filter over
> any FS’s control device object c) filter mount requests
> > d) add a filter to the FS’s volume device object just after successful
> mount.
> > See SFILTER sample for details - though it seems to have some bug in mount
> path.
> >
> > Max
> >
> >
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@vba.com.by
> > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
Yes, a wrong way.
Study the SFILTER source for a knowlegde how to do this correctly.
Technically, you can even copy-paste from SFILTER, but a) I’m not sure this is legal - did MS give it away? b) I personally do not
like copying from samples.
Max
----- Original Message -----
From: “Alexey Logachyov”
To: “NT Developers Interest List”
Sent: Sunday, September 30, 2001 2:49 AM
Subject: [ntdev] Re: how to get drive letter (or volume name)
> Look guys. I mean you, Max, and Dennis. Seems like you are more competent in
> the question than I am. Could you tell me if I’m doing everything wrong? I
> work in an antivirus company. I have to write a driver that intercepts all
> the file open, write, close, and rename operations. May be I started with a
> wrong way?
>
> ----- Original Message -----
> From: “Maxim S. Shatskih”
> To: “NT Developers Interest List”
> Sent: Friday, September 28, 2001 20:25
> Subject: [ntdev] Re: how to get drive letter (or volume name)
>
>
> > MountMgr is a kernel-mode piece of code which assigns symlinks like \.\D:
> to the disk stacks.
> > It maintains a database of volume GUID -> drive letter mappings to do
> this.
> >
> > Max
> >
> > ----- Original Message -----
> > From: “Alexey Logachyov”
> > To: “NT Developers Interest List”
> > Sent: Friday, September 28, 2001 5:15 PM
> > Subject: [ntdev] Re: how to get drive letter (or volume name)
> >
> >
> > > What about NT4? And another question - who is mount manager. I heared
> > > several times about it but what is its driver name and what devices does
> it
> > > create?
> > >
> > > Anyway, thank you for reply.
> > >
> > > P.S. Oh, yes. What are the parameters for IOCTL_MOUNTMGR_QUERY_POINTS?
> > >
> > > ----- Original Message -----
> > > From: “Dennis S. Dyatlov”
> > > To: “NT Developers Interest List”
> > > Sent: Friday, September 28, 2001 8:39
> > > Subject: [ntdev] Re: how to get drive letter (or volume name)
> > >
> > >
> > > > Under Win2K you can retrieve drive letter using
> > > IOCTL_MOUNTMGR_QUERY_POINTS.
> > > >
> > > > Regards,
> > > > Dennis.
> > > >
> > > > ----- Original Message -----
> > > > From: “Alexey Logachyov”
> > > > To: “NT Developers Interest List”
> > > > Sent: Friday, September 28, 2001 1:12 AM
> > > > Subject: [ntdev] how to get drive letter (or volume name)
> > > >
> > > >
> > > > > OK, here’s the situation. I’m installing hooks on NTFS. I first get
> > > > > PDEVICE_OBJECT for ‘\Ntfs’ device. Then enumerate all devices
> created
> > > by
> > > > > ‘\Ntfs’ (one device created for every NTFS volume) and install
> filter
> > > > > device for each of them. Everything is fine except for I cannot get
> > > drive
> > > > > letter.
> > > > >
> > > > > P.S. This all is a little bit messy but if you want the situation
> > > > described
> > > > > better - I can do that.
> > > > >
> > > > >
> > > > >
> > > > > —
> > > > > You are currently subscribed to ntdev as: xxxxx@acronis.ru
> > > > > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> > > > >
> > > >
> > > >
> > > > —
> > > > You are currently subscribed to ntdev as: xxxxx@vba.com.by
> > > > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> > >
> > >
> > > —
> > > You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> > > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> > >
> >
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@vba.com.by
> > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
Yes I know that I can buy it. But it IS expensive. I have to work 5 months
to buy it (in case I don’t spare my money for anything else, but I want eat
every day, several times a day).
----- Original Message -----
From: “Mark Roddy”
To: “NT Developers Interest List”
Sent: Sunday, September 30, 2001 1:33
Subject: [ntdev] Re: how to get drive letter (or volume name)
> Alexey,
>
> You need to give BillG some money and get the IFS kit. See the DDK page
> at microsoft, its listed there. It isn’t too terribly expensive.
>
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com] On Behalf Of Alexey Logachyov
> > Sent: Saturday, September 29, 2001 6:19 PM
> > To: NT Developers Interest List
> > Subject: [ntdev] Re: how to get drive letter (or volume name)
> >
> >
> > That’s great but my driver is not loaded during Windows
> > startup. So I would probably miss all of FS registration
> > changes. I know that I will have to that anyway to watch
> > mount changes.
> >
> > Could you send me sfilter sources? I heared about it several
> > times but I don’t have it.
> >
> > ----- Original Message -----
> > From: “Maxim S. Shatskih”
> > To: “NT Developers Interest List”
> > Sent: Friday, September 28, 2001 19:58
> > Subject: [ntdev] Re: how to get drive letter (or volume name)
> >
> >
> > > > OK, here’s the situation. I’m installing hooks on NTFS. I
> > first get
> > > > PDEVICE_OBJECT for ‘\Ntfs’ device. Then enumerate all devices
> > > > created
> > by
> > > > ‘\Ntfs’ (one device created for every NTFS volume)
> > >
> > > Wrong. You must a) filter the FS registration changes b)
> > add a filter
> > > over
> > any FS’s control device object c) filter mount requests
> > > d) add a filter to the FS’s volume device object just after
> > successful
> > mount.
> > > See SFILTER sample for details - though it seems to have
> > some bug in
> > > mount
> > path.
> > >
> > > Max
> > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntdev as: xxxxx@vba.com.by
> > > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> >
> >
> > —
> > You are currently subscribed to ntdev as:
> > xxxxx@hollistech.com To unsubscribe send a blank email to
> > leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> >
> >
>
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
I don’t like copying either. But I don’t have IFSKit at all. And I don’t
have opportunity to have it 
I already understood that SFilter can help me
greatly. But probably you could send it to me?
----- Original Message -----
From: “Maxim S. Shatskih”
To: “NT Developers Interest List”
Sent: Sunday, September 30, 2001 4:17
Subject: [ntdev] Re: how to get drive letter (or volume name)
> Yes, a wrong way.
> Study the SFILTER source for a knowlegde how to do this correctly.
>
> Technically, you can even copy-paste from SFILTER, but a) I’m not sure
this is legal - did MS give it away? b) I personally do not
> like copying from samples.
>
> Max
>
> ----- Original Message -----
> From: “Alexey Logachyov”
> To: “NT Developers Interest List”
> Sent: Sunday, September 30, 2001 2:49 AM
> Subject: [ntdev] Re: how to get drive letter (or volume name)
>
>
> > Look guys. I mean you, Max, and Dennis. Seems like you are more
competent in
> > the question than I am. Could you tell me if I’m doing everything wrong?
I
> > work in an antivirus company. I have to write a driver that intercepts
all
> > the file open, write, close, and rename operations. May be I started
with a
> > wrong way?
> >
> > ----- Original Message -----
> > From: “Maxim S. Shatskih”
> > To: “NT Developers Interest List”
> > Sent: Friday, September 28, 2001 20:25
> > Subject: [ntdev] Re: how to get drive letter (or volume name)
> >
> >
> > > MountMgr is a kernel-mode piece of code which assigns symlinks like
\.\D:
> > to the disk stacks.
> > > It maintains a database of volume GUID -> drive letter mappings to do
> > this.
> > >
> > > Max
> > >
> > > ----- Original Message -----
> > > From: “Alexey Logachyov”
> > > To: “NT Developers Interest List”
> > > Sent: Friday, September 28, 2001 5:15 PM
> > > Subject: [ntdev] Re: how to get drive letter (or volume name)
> > >
> > >
> > > > What about NT4? And another question - who is mount manager. I
heared
> > > > several times about it but what is its driver name and what devices
does
> > it
> > > > create?
> > > >
> > > > Anyway, thank you for reply.
> > > >
> > > > P.S. Oh, yes. What are the parameters for
IOCTL_MOUNTMGR_QUERY_POINTS?
> > > >
> > > > ----- Original Message -----
> > > > From: “Dennis S. Dyatlov”
> > > > To: “NT Developers Interest List”
> > > > Sent: Friday, September 28, 2001 8:39
> > > > Subject: [ntdev] Re: how to get drive letter (or volume name)
> > > >
> > > >
> > > > > Under Win2K you can retrieve drive letter using
> > > > IOCTL_MOUNTMGR_QUERY_POINTS.
> > > > >
> > > > > Regards,
> > > > > Dennis.
> > > > >
> > > > > ----- Original Message -----
> > > > > From: “Alexey Logachyov”
> > > > > To: “NT Developers Interest List”
> > > > > Sent: Friday, September 28, 2001 1:12 AM
> > > > > Subject: [ntdev] how to get drive letter (or volume name)
> > > > >
> > > > >
> > > > > > OK, here’s the situation. I’m installing hooks on NTFS. I first
get
> > > > > > PDEVICE_OBJECT for ‘\Ntfs’ device. Then enumerate all devices
> > created
> > > > by
> > > > > > ‘\Ntfs’ (one device created for every NTFS volume) and install
> > filter
> > > > > > device for each of them. Everything is fine except for I cannot
get
> > > > drive
> > > > > > letter.
> > > > > >
> > > > > > P.S. This all is a little bit messy but if you want the
situation
> > > > > described
> > > > > > better - I can do that.
> > > > > >
> > > > > >
> > > > > >
> > > > > > —
> > > > > > You are currently subscribed to ntdev as: xxxxx@acronis.ru
> > > > > > To unsubscribe send a blank email to
leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> > > > > >
> > > > >
> > > > >
> > > > > —
> > > > > You are currently subscribed to ntdev as: xxxxx@vba.com.by
> > > > > To unsubscribe send a blank email to
leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> > > >
> > > >
> > > > —
> > > > You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> > > > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> > > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntdev as: xxxxx@vba.com.by
> > > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> >
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> >
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
I can tell you’re wrong. My current implementation filter pretty well.
----- Original Message -----
From: “Maxim S. Shatskih”
To: “NT Developers Interest List”
Sent: Sunday, September 30, 2001 4:14
Subject: [ntdev] Re: how to get drive letter (or volume name)
> Filesystem filters must be loaded at boot before even the SystemRoot
volume mounts.
> Otherwise, they will not be able to filter any volumes mounted before the
filter loaded.
>
> Max
>
> ----- Original Message -----
> From: “Alexey Logachyov”
> To: “NT Developers Interest List”
> Sent: Sunday, September 30, 2001 2:19 AM
> Subject: [ntdev] Re: how to get drive letter (or volume name)
>
>
> > That’s great but my driver is not loaded during Windows startup. So I
would
> > probably miss all of FS registration changes. I know that I will have to
> > that anyway to watch mount changes.
> >
> > Could you send me sfilter sources? I heared about it several times but I
> > don’t have it.
> >
> > ----- Original Message -----
> > From: “Maxim S. Shatskih”
> > To: “NT Developers Interest List”
> > Sent: Friday, September 28, 2001 19:58
> > Subject: [ntdev] Re: how to get drive letter (or volume name)
> >
> >
> > > > OK, here’s the situation. I’m installing hooks on NTFS. I first get
> > > > PDEVICE_OBJECT for ‘\Ntfs’ device. Then enumerate all devices
created
> > by
> > > > ‘\Ntfs’ (one device created for every NTFS volume)
> > >
> > > Wrong. You must a) filter the FS registration changes b) add a filter
over
> > any FS’s control device object c) filter mount requests
> > > d) add a filter to the FS’s volume device object just after successful
> > mount.
> > > See SFILTER sample for details - though it seems to have some bug in
mount
> > path.
> > >
> > > Max
> > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntdev as: xxxxx@vba.com.by
> > > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> >
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> >
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
Look at the SysInternals FileMon sample.
You can download it from www.sysinternals.com
Kristian
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
Did YOU look at it? Look - it works completely (almost) different way. It
doesn’t hook device and looks for its letter. It opens files like
\DosDevices\A:, and hooks their related device objects.
----- Original Message -----
From:
To: “NT Developers Interest List”
Sent: Monday, October 01, 2001 4:57
Subject: [ntdev] Re: how to get drive letter (or volume name)
> Look at the SysInternals FileMon sample.
> You can download it from www.sysinternals.com
>
> Kristian
>
> —
> You are currently subscribed to ntdev as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com