I could not get the mount/dismount event for USB Memory Key under Win2000.

NTFSD
1

I want to trace the file access based on FileSpy in IFS Kit.
My filter driver start with boot (Start=0), and I can get the Notification
of
mount/dismount event for USB devices except USB memory key in Windows 2000.
There is no problem with Windows XP.
How can I get the mount/dismount event for USB memory key ?
Can I need to check the some IRP_MJ_PNP ?

2

I’m tried to get the IRP_MJ_PNP event in Dispatch routine.
But theres is no event when I connect the USB Memory Key to PC under
Win2000.
How to detect that USB memory key was connected to PC by filter driver ?

Tohru

3

You should receive IRP_MJ_FILE_SYSTEM_CONTROL
with IRP_MJ_MOUNT_VOLUME, right ?

L.

4

I’ve read your original posting more carefully …

Your driver starts at “0”, could you tell me what group ?
If it does not work under Win2000 only, it could be
that you driver loads AFTER the file systems.

L.

5

Ladislav, Thank you to reply for my question.
After post the question, I tried with another Windows 2000 machines, and
some machines work fine. So, now I tried the difference between bad and good
machines.

Anyway, my situation was …
I load the my driver with “Start = 0” and I think that my driver load before
any FileSystem. Because I have no trable with USB Hard Drive.
And when I attach the USB memory key, there is NO IPR_MJ_FILE_SYSTEM_CONTROL
and IRP_MJ_PNP message.
(But this USB memory key can use in Windows and drive letter was assigned.)

“Ladislav Zezula” wrote in message news:xxxxx@ntfsd…
> You should receive IRP_MJ_FILE_SYSTEM_CONTROL
> with IRP_MJ_MOUNT_VOLUME, right ?
>
> L.
>

6

I could resolve the my problem. Thank you to reply the my question.

Tohru