How to protect disk from being formatted?

NTFSD
1

Hi,

I’m writing a File System Filter Driver. Now, I want to protect my flash-disk from being formatted! I trace all the IRPs sent whem my flash-disk is formatted. Some IRPs maybe important, they are: IRP_MJ_QUERY_INFORMATION, IRP_MJ_DEVICE_CONTROL, IRP_MJ_SET_VOLUME_INFORMATION.

What IRP should I intercept to protect my flash-disk or hdd from being formatted?

Thanks!

2

Prohibit FSCTL_LOCK_VOLUME, this is maybe the best method. This will also
prohibit CHKDSK /F and CHKDSK /R.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From:
To: “Windows File Systems Devs Interest List”
Sent: Sunday, October 15, 2006 7:18 PM
Subject: [ntfsd] How to protect disk from being formatted?

> Hi,
>
> I’m writing a File System Filter Driver. Now, I want to protect my flash-disk
from being formatted! I trace all the IRPs sent whem my flash-disk is
formatted. Some IRPs maybe important, they are: IRP_MJ_QUERY_INFORMATION,
IRP_MJ_DEVICE_CONTROL, IRP_MJ_SET_VOLUME_INFORMATION.
>
> What IRP should I intercept to protect my flash-disk or hdd from being
formatted?
>
> Thanks!
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

3

You don’t have to take that lock to format a volume. The standard utilities
will use it, but since formatting is just really a write of the system
areas, anyone can format a volume. It would be a bad idea if another
program has an open file, but it will work most of the time. It is not good
practice, but the ‘protection’ will be limited.

“Maxim S. Shatskih” wrote in message
news:xxxxx@ntfsd…
> Prohibit FSCTL_LOCK_VOLUME, this is maybe the best method. This will
> also
> prohibit CHKDSK /F and CHKDSK /R.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
> ----- Original Message -----
> From:
> To: “Windows File Systems Devs Interest List”
> Sent: Sunday, October 15, 2006 7:18 PM
> Subject: [ntfsd] How to protect disk from being formatted?
>
>
>> Hi,
>>
>> I’m writing a File System Filter Driver. Now, I want to protect my
>> flash-disk
> from being formatted! I trace all the IRPs sent whem my flash-disk is
> formatted. Some IRPs maybe important, they are: IRP_MJ_QUERY_INFORMATION,
> IRP_MJ_DEVICE_CONTROL, IRP_MJ_SET_VOLUME_INFORMATION.
>>
>> What IRP should I intercept to protect my flash-disk or hdd from being
> formatted?
>>
>> Thanks!
>>
>>
>> —
>> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>>
>> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>

4

Then, I’d like to know one thing!
Formatting is just an operation of File System. Then, how does the FS format a volume?

5

Read this source, it will awnser your question

http://www.sysinternals.com/SourceCode/fmifs.html

m.

headium2006@163.com wrote:

Then, I’d like to know one thing!
Formatting is just an operation of File System. Then, how does the FS format a volume?

Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

6

Formatting is NOT an operation of the File Systems in Windows. It might be
a little for floppies, but otherwise not at all.

wrote in message news:xxxxx@ntfsd…
> Then, I’d like to know one thing!
> Formatting is just an operation of File System. Then, how does the FS
> format a volume?
>

7

Thanks for all replies!
It seems that formatting is quite a complex process!

8

hook the api in fmifs.dll