Identifying FS metadata io in FSFD

NTFSD
1

In a FSF driver how do i know that the read/write is FS metadata read/write.

2

One approach I have seen for NTFS is to query the file internal information which provides the NTFS file identifier, bitand with ~0XF0000000, and if the result is less than 16, this is an NTFS metadata file. This approach might not be 100% correct …

“Mani” wrote in message news:xxxxx@ntfsd…
In a FSF driver how do i know that the read/write is FS metadata read/write.

3

I think there is not a simple way to do this.
You better check for the files that you want to filter. Then mark them
(e.g. using filter context, or using hash table). And just ignore anything
else.

L.

4

> bitand with ~0XF0000000, and if the result is less than 16

This is correct and works in my mini-filter.