ID of a file write operation

NTFSD
1

Hello!

I am looking for an ID of a write operation. What I mean is that when I copy a “big” file, and I have many Write IRPs for the copy operation, I want to know when the operation has finished.

I could do it by saving the path to the file written in a global variable, but if I just save the file again, or overwrite it, my driver will think it’s the same one. So I am looking for an identifier for a file write operation, which will be the same for all write IRP’s of the same file save. (Or copy…)

I would be very thankful if anyone could help me with that!

2

Well as we have already had the discussion there can be a lot of ways to
copy / save a file. But for most of these, the common model is to create
the file, write it, then close the file. This means that you will be
seeing a FILE_OBJECT that will stay the same for all of these operations.

Assuming you are doing a mini-fitler you can use a context to capture that
and keep the info.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply

wrote in message news:xxxxx@ntfsd…
> Hello!
>
> I am looking for an ID of a write operation. What I mean is that when I
> copy a “big” file, and I have many Write IRPs for the copy operation, I
> want to know when the operation has finished.
>
> I could do it by saving the path to the file written in a global variable,
> but if I just save the file again, or overwrite it, my driver will think
> it’s the same one. So I am looking for an identifier for a file write
> operation, which will be the same for all write IRP’s of the same file
> save. (Or copy…)
>
> I would be very thankful if anyone could help me with that!
>

3

No, I am writing a legacy driver.

My question is: If I save a file named “temp.txt”, it will have some FILE_OBJECT structure, then I close the file, open it, and save it again - will it have the same FILE_OBJECT structure, or a different one?

Thanks!

4

Yes, it will either be the same one or a different one.

If it is opened and then opened again (before the first open is closed) then you know it will be a different file object. But if it is opened and then closed, the system might reuse the memory region for a file object (I have seen this many times.)

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

5

So if I want to know when a new copy starts, the FILE_OBJECT structure does not help me because it may be the same every time. So, do I have an ID or something like this for me to know when one copy ends and a new one begins? Even if it is the same file at the same path exactly?

6

It isn’t going to be easy. Prepare for several days of testing and
analysis, but I would suggest starting with IRP_MJ_CLEANUP. That will let
you know that no user activity should be seen again even though the cache
manager and/or memory manager may have some. Test using the standard copy
tools, then write your own where you map a file on the read and then write
it to the new location. See what activity you can find. Why would you
expect those who have done this to tell you all the exceptions and quirks
they have seen? They may be under NDA, if a consultant, or an employment
agreement. It is a lot of work, mostly boring. It is just like the
questions about how the various office programs handle files. It varies
somewhat between versions and definitely varies between the different
programs.

wrote in message news:xxxxx@ntfsd…
> So if I want to know when a new copy starts, the FILE_OBJECT structure
> does not help me because it may be the same every time. So, do I have an
> ID or something like this for me to know when one copy ends and a new one
> begins? Even if it is the same file at the same path exactly?
>

7

Alright, thank you very much! I will start the testing…

8

>save the file again, or overwrite it, my driver will think it’s the same one.
So I am

looking for an identifier for a file write operation, which will be the same
for all
write IRP’s of the same file save. (Or copy…)

Impossible. Windows just does not support such a thing.

–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

9

> My question is: If I save a file named “temp.txt”, it will have some
FILE_OBJECT

structure, then I close the file, open it, and save it again - will it have
the same
FILE_OBJECT structure, or a different one?

Different, but probably at the same address as the old one.

–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

10

I don’t know if I would go so far as to say probably at the same
address. It’s certainly possible, but in doing testing for the project
I’m working on, FILE_OBJECT structures appear to get recycled fairly
quickly. I.e. if you close one file that you’ve been tracking by it’s
FILE_OBJECT stucture’s address, you can see a completely different file
in that slot within well under a minute.

Mind you I haven’t taken the time to quantify the range of addresses
FILE_OBJECTs occupy, or how many objects actually get used/reused when
the system isn’t under load, but just from watching I wouldn’t make any
bets about whether or not you’ll find a file in the same one as you did
last time you opened it.

~Eric

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S.
Shatskih
Sent: Monday, October 15, 2007 2:25 PM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] ID of a file write operation

My question is: If I save a file named “temp.txt”, it will have some
FILE_OBJECT
structure, then I close the file, open it, and save it again - will it
have
the same
FILE_OBJECT structure, or a different one?

Different, but probably at the same address as the old one.

–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@edsiohio.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

11

>address. It’s certainly possible, but in doing testing for the project

I’m working on, FILE_OBJECT structures appear to get recycled fairly
quickly.

Exactly. The old FILE_OBJECT is deleted in MJ_CLOSE path, and then the new file
object is created in the very same memory location.

Tracking MJ_CLOSE is the only way to catch such situations.

–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

12

"> My question is: If I save a file named “temp.txt”, it will have some FILE_OBJECT

structure, then I close the file, open it, and save it again - will it have the same
FILE_OBJECT structure, or a different one?

Different, but probably at the same address as the old one."

So if I save the current structure in a temporary variable, and when I do the second Save compare
it’s FILE_OBJECT with the temporary one - they will be the same or not? What I understand from your words is that they will be different. Right?

13

The k+1’th FILE_OBJECT might or might not be at the same address as the k’th
file object. Whether or not the address might or might not be the same has
no meaning. That is all there is to be said about the matter.

wrote in message news:xxxxx@ntfsd…
>“> My question is: If I save a file named “temp.txt”, it will have some
>FILE_OBJECT
>>structure, then I close the file, open it, and save it again - will it
>>have the same
>>FILE_OBJECT structure, or a different one?
>
> Different, but probably at the same address as the old one.”
>
> So if I save the current structure in a temporary variable, and when I do
> the second Save compare
> it’s FILE_OBJECT with the temporary one - they will be the same or not?
> What I understand from your words is that they will be different. Right?
>

14

Saving the pointer to the FILE_OBJECT would be an almost sure-fire
recipe for a mismatch. Saving the whole structure itself doesn’t sound
like such a hot idea either: “A file object is partially opaque. Certain
types of drivers, such as file system drivers and network transport
drivers, use some of the fields of file objects.”
http://msdn2.microsoft.com/en-us/library/aa906961.aspx.

Note the use of the phrase “partially opaque”, that means there’s a
whole bunch of stuff that you probably shouldn’t assume will remain
constant between different openings of the same file. In fact, you
shouldn’t assume anything about it. The documentation will tell you
which members are opaque, and you can decide for yourself if you think
copying the stucture will work, but I’m guessing that anybody here with
a lot of experience (i.e. somebody besides me) will tell you that it
probably won’t work.

~Eric

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@gmail.com
Sent: Tuesday, October 16, 2007 4:04 AM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] ID of a file write operation

"> My question is: If I save a file named “temp.txt”, it will have some
FILE_OBJECT

structure, then I close the file, open it, and save it again - will it
have the same FILE_OBJECT structure, or a different one?

Different, but probably at the same address as the old one."

So if I save the current structure in a temporary variable, and when I
do the second Save compare it’s FILE_OBJECT with the temporary one -
they will be the same or not? What I understand from your words is that
they will be different. Right?

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars (including our new
fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@edsiohio.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

15

> So if I save the current structure in a temporary variable, and when I do the

second Save compare

No, you should track MJ_CLOSE instead.

–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com