How to make use of FsContext & FsContext2 in file system filter driver?

NTFSD
1

Hi,

Can anybody tell me what FileObject->FsContext
and FileObject->FsContext2 mean? How to use them in our file
system filter driver?

Thanks,

Chen Z.M

2

these 2 are pointers to file system specific structures, so they are not
useful to filter drivers. the only thing that filter drivers can use is the
first field in FileObject->FsContext, which is the FSRTL_COMMON_FCB_HEADER
or the FSRTL_ADVANCED_FCB_HEADER defined in the IFS kit.

Ho Mun Chuen
@@ “Not everything that counts can be counted;
<” )~ and not everything that can be counted counts"
//\ … Albert Einstein
----- Original Message -----
From: “Chen ZM”
To: “File Systems Developers”
Sent: Friday, November 01, 2002 11:17 AM
Subject: [ntfsd] How to make use of FsContext & FsContext2 in file system
filter driver?

Hi,

Can anybody tell me what FileObject->FsContext
and FileObject->FsContext2 mean? How to use them in our file
system filter driver?

Thanks,

Chen Z.M

—
You are currently subscribed to ntfsd as: xxxxx@pmail.ntu.edu.sg
To unsubscribe send a blank email to %%email.unsub%%

3

You can use FsContext to track on-disk files. Every file object
(PFILE_OBJECT) that represents the same file on disk has the same FsContext
value.

----- Original Message -----
From: “Ho Mun Chuen”
To: “File Systems Developers”
Sent: Friday, November 01, 2002 6:39 AM
Subject: [ntfsd] Re: How to make use of FsContext & FsContext2 in file
system filter driver?

> these 2 are pointers to file system specific structures, so they are not
> useful to filter drivers. the only thing that filter drivers can use is
the
> first field in FileObject->FsContext, which is the FSRTL_COMMON_FCB_HEADER
> or the FSRTL_ADVANCED_FCB_HEADER defined in the IFS kit.
>
> Ho Mun Chuen
> @@ “Not everything that counts can be counted;
> <” )~ and not everything that can be counted counts"
> //\ … Albert Einstein
> ----- Original Message -----
> From: “Chen ZM”
> To: “File Systems Developers”
> Sent: Friday, November 01, 2002 11:17 AM
> Subject: [ntfsd] How to make use of FsContext & FsContext2 in file system
> filter driver?
>
>
> Hi,
>
> Can anybody tell me what FileObject->FsContext
> and FileObject->FsContext2 mean? How to use them in our file
> system filter driver?
>
> Thanks,
>
> Chen Z.M
>
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@pmail.ntu.edu.sg
> To unsubscribe send a blank email to %%email.unsub%%
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to %%email.unsub%%
>

4

To be more precise, each file object that represents the same STREAM
will have the same FsContext value.

Since FAT volumes do not support multiple stream per file, it is
equivalent to representing the entire file. On NTFS however, since you
can have multiple streams per file, this only uniquely identifies all
opens for the same stream.

Neal Christiansen
Microsoft File System Filter Group

This posting is provided “AS IS” with no warranties, and confers no
rights.

-----Original Message-----
From: Alexey Logachyov [mailto:xxxxx@vba.com.by]
Sent: Thursday, October 31, 2002 11:05 PM
To: File Systems Developers
Subject: [ntfsd] Re: How to make use of FsContext & FsContext2 in file
system filter driver?

You can use FsContext to track on-disk files. Every file object
(PFILE_OBJECT) that represents the same file on disk has the same
FsContext
value.

----- Original Message -----
From: “Ho Mun Chuen”
To: “File Systems Developers”
Sent: Friday, November 01, 2002 6:39 AM
Subject: [ntfsd] Re: How to make use of FsContext & FsContext2 in file
system filter driver?

> these 2 are pointers to file system specific structures, so they are
not
> useful to filter drivers. the only thing that filter drivers can use
is
the
> first field in FileObject->FsContext, which is the
FSRTL_COMMON_FCB_HEADER
> or the FSRTL_ADVANCED_FCB_HEADER defined in the IFS kit.
>
> Ho Mun Chuen
> @@ “Not everything that counts can be counted;
> <” )~ and not everything that can be counted counts"
> //\ … Albert Einstein
> ----- Original Message -----
> From: “Chen ZM”
> To: “File Systems Developers”
> Sent: Friday, November 01, 2002 11:17 AM
> Subject: [ntfsd] How to make use of FsContext & FsContext2 in file
system
> filter driver?
>
>
> Hi,
>
> Can anybody tell me what FileObject->FsContext
> and FileObject->FsContext2 mean? How to use them in our file
> system filter driver?
>
> Thanks,
>
> Chen Z.M
>
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@pmail.ntu.edu.sg
> To unsubscribe send a blank email to %%email.unsub%%
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to %%email.unsub%%
>

—
You are currently subscribed to ntfsd as: xxxxx@Windows.Microsoft.com
To unsubscribe send a blank email to %%email.unsub%%

5

By no means the FS filters are allowed to touch anything in FCB
header. Only XP-specific functions can be used to operate it and add
states to it.

Nevertheless, the filter can use the “value itself” (casted to
ULONG_PTR) of FsContext as file object’s identity. 2 file objects with
the same FsContext are referencing the same on-disk file. Sort of
guarantee.

Nevertheless, this can be broken on NTFS with its stream file objects.

Max

----- Original Message -----
From: “Ho Mun Chuen”
To: “File Systems Developers”
Sent: Friday, November 01, 2002 7:39 AM
Subject: [ntfsd] Re: How to make use of FsContext & FsContext2 in file
system filter driver?

> these 2 are pointers to file system specific structures, so they are
not
> useful to filter drivers. the only thing that filter drivers can use
is the
> first field in FileObject->FsContext, which is the
FSRTL_COMMON_FCB_HEADER
> or the FSRTL_ADVANCED_FCB_HEADER defined in the IFS kit.
>
> Ho Mun Chuen
> @@ “Not everything that counts can be counted;
> <” )~ and not everything that can be counted counts"
> //\ … Albert Einstein
> ----- Original Message -----
> From: “Chen ZM”
> To: “File Systems Developers”
> Sent: Friday, November 01, 2002 11:17 AM
> Subject: [ntfsd] How to make use of FsContext & FsContext2 in file
system
> filter driver?
>
>
> Hi,
>
> Can anybody tell me what FileObject->FsContext
> and FileObject->FsContext2 mean? How to use them in our file
> system filter driver?
>
> Thanks,
>
> Chen Z.M
>
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@pmail.ntu.edu.sg
> To unsubscribe send a blank email to %%email.unsub%%
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to %%email.unsub%%
>