HOW TO KNOW WHICH FILE IS BEING WRITTEN INTO DISK.....

NTDEV
1

Hi All,

I am a beginner in driver development …So this might be a silly question…

I am developing a disk filter driver…

I am trying to find out which file is written/read to the hard disk in a read/write IRP at a particular moment…

I am trying to get this thru a filter driver … I could track the READ/WRITE IRPs …Is it possible to get the informations like which file is currently written / read in a particular IRP transaction …

Could you please help me …

Thanks in advance,

Nanda

Do you Yahoo!?
Yahoo! Mail Address AutoComplete - You start. We finish.

2

Nanda,

It is indeed a silly question, however you cleverly immunized yourself from
our scorn, wrath, and flames by apologizing beforehand.

Disk filters are the wrong level in the OS abstraction to know anything
useful about files. Filesystem filters are the appropriate abstraction
level.

Good luck.

By the way filesystem filter drivers are discussed all by themselves over on
the ntfsd email list. We don’t let them post over here because they are
obnoxious trolls who insist on having useful discussions on technical issues
relevant to the email list. That sort of bad behavior is simply not
tolerated here.

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of naan Thaan
Sent: Tuesday, August 03, 2004 5:34 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] HOW TO KNOW WHICH FILE IS BEING WRITTEN INTO
DISK…

Hi All,

I am a beginner in driver development …So this might be a
silly question…

I am developing a disk filter driver…

I am trying to find out which file is written/read to the hard disk
in a read/write IRP at a particular moment…

I am trying to get this thru a filter driver … I could track the
READ/WRITE IRPs …Is it possible to get the informations like which file is
currently written / read in a particular IRP transaction …

Could you please help me …

Thanks in advance,

Nanda

Do you Yahoo!?
Yahoo! Mail Address AutoComplete
http:w_mail/static/ease.html> - You start. We finish. — Questions? First check
the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256 You are
currently subscribed to ntdev as: xxxxx@hollistech.com To unsubscribe send a
blank email to xxxxx@lists.osr.com</http:>