how to mount all drives available

NTFSD
1

hi all,
i am developing FS filter. It is a boot time driver.I am using filespy of
IFS toolkit.
In filespy the UI calls attach drive name and then driver start monitoring
perticular drive.
Now my problem is that, as my driver is boot time, i want to attach and
start logging activities for all the logical drives present.

Pls tell me what should i modify in the file spy code. I am a begginer.

Thanks and Regards,
Naren

2

If you’ve got the version from the Windows XP SP1 IFS Kit or later,
filespy attaches to all volumes as the mount. If you’ve got an earlier
version of the IFS Kit, you want to look at the Sfilter sample to see
how to make a filter attach as devices mount and make the appropriate
changes to filespy.

Once you’ve got filespy attaching at mount time it will not log because
the SHOULD_LOG test would fail (since the user mode program does not
have the filespy control device open). You could change that test so
that it will log regardless of the gControlDeviceState. You would also
need to initialize each of filespy’s attached devices to be set into the
LogThisDevice state. One other point to consider is that FileSpy has
limits as to how many log records it will queue at a time. If the user
mode program doesn’t come up quickly to consume the log records, new log
records will stop being added to the queue. You could up this limit if
that’s a problem for you, but you may want to reconsider the design of
the user mode consumer so that you don’t require user intervention for
it to start.

Molly Brown
Microsoft Corporation

This posting is provided “AS IS” with no warranties and confers no
rights.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of narendra.bhongale
Sent: Saturday, August 21, 2004 6:26 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] how to mount all drives available

hi all,
i am developing FS filter. It is a boot time driver.I am using filespy
of
IFS toolkit.
In filespy the UI calls attach drive name and then driver start
monitoring
perticular drive.
Now my problem is that, as my driver is boot time, i want to attach and
start logging activities for all the logical drives present.

Pls tell me what should i modify in the file spy code. I am a begginer.

Thanks and Regards,
Naren

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Hi Molly,

Thanks for the reply.

I found it useful, made changes as you said , and its working. But I am
facing a new problem now. I am not getting full name of the file. I am
printing name of the file in SpyPassThrough. Eg. If XXX is on c:, then it
gives the name as ->\XXX and not C:\XXX
Why it is so?
I am using following code

nameLength = (ULONG)(wcslen(recordList->LogRecord.Name) * sizeof(WCHAR));
RtlStringCchPrintfA(psFileName, nameLength, “%.*S”,
nameLength/sizeof(WCHAR), recordList->LogRecord.Name); DbgPrint(“>>
^%.*S^”, nameLength/sizeof(WCHAR), recordList->LogRecord.Name);

If i keep this code in original FileSpy it works. And How to get the name
of the file as \Device\HardDiskVolume1.…

Do I need to modify my code more to get correct name?

Thanks and Regards,
Naren.

Always with friends…

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Molly Brown
Sent: Saturday, August 21, 2004 8:41 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] how to mount all drives available

If you’ve got the version from the Windows XP SP1 IFS Kit or later,
filespy attaches to all volumes as the mount. If you’ve got an earlier
version of the IFS Kit, you want to look at the Sfilter sample to see how
to make a filter attach as devices mount and make the appropriate changes
to filespy.

Once you’ve got filespy attaching at mount time it will not log because
the SHOULD_LOG test would fail (since the user mode program does not have
the filespy control device open). You could change that test so that it
will log regardless of the gControlDeviceState. You would also need to
initialize each of filespy’s attached devices to be set into the
LogThisDevice state. One other point to consider is that FileSpy has
limits as to how many log records it will queue at a time. If the user
mode program doesn’t come up quickly to consume the log records, new log
records will stop being added to the queue. You could up this limit if
that’s a problem for you, but you may want to reconsider the design of the
user mode consumer so that you don’t require user intervention for it to
start.

Molly Brown
Microsoft Corporation

This posting is provided “AS IS” with no warranties and confers no rights.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of narendra.bhongale
Sent: Saturday, August 21, 2004 6:26 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] how to mount all drives available

hi all,
i am developing FS filter. It is a boot time driver.I am using filespy of
IFS toolkit. In filespy the UI calls attach drive name and then driver
start monitoring perticular drive. Now my problem is that, as my driver is
boot time, i want to attach and start logging activities for all the
logical drives present.

Pls tell me what should i modify in the file spy code. I am a bigginer.

Thanks and Regards,
Naren

4

> gives the name as ->\XXX and not C:\XXX

This is because in the world of the filter drivers and FSDs,
there are no drive letters, there are volumes, each represented
by the volume object. And volume is stored
within the FileObject itself (fileobject->DeviceObject)

The best way for you is to try to redesign the whole project
not to be dependent on the drive letter.

Or, you may use RtlDeviceToDosLetter

L.