Identifying the correct write in FS filter

NTFSD
1

Hi,

I’m working on a FS filter that logs writes to a set of files, that
can be replayed if required.

If I copy a small file of size say 1000 bytes, I get two writes - one
with exactly 1000 bytes of data, and one with 4096 bytes of data with
first 1000 bytes containing the correct data followed by all zeros.
The second write has a IRP_PAGING_IO bit set.

If I ignote the write with IRP_PAGING_IO bit set, this case works
fine, but I loose almost all writes when applications like Word saves
a file.

How can I identify wheather the second type of writes should be ignored or not?

Thanks,
Hrishikesh.

2

Your starter for ten …

(((PFSRTL_COMMON_FCB_HEADER)(FileObject->FsContext))->Flags &
FSRTL_FLAG_USER_MAPPED_FILE)

…?

“Hrishikesh Vidwans” wrote in message
news:xxxxx@ntfsd…
Hi,

I’m working on a FS filter that logs writes to a set of files, that
can be replayed if required.

If I copy a small file of size say 1000 bytes, I get two writes - one
with exactly 1000 bytes of data, and one with 4096 bytes of data with
first 1000 bytes containing the correct data followed by all zeros.
The second write has a IRP_PAGING_IO bit set.

If I ignote the write with IRP_PAGING_IO bit set, this case works
fine, but I loose almost all writes when applications like Word saves
a file.

How can I identify wheather the second type of writes should be ignored or
not?

Thanks,
Hrishikesh.

3

Catch only (and all) IRP_NONCACHED_IO writes. These are the real disk
writes.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Hrishikesh Vidwans”
To: “Windows File Systems Devs Interest List”
Sent: Saturday, May 07, 2005 9:59 PM
Subject: [ntfsd] Identifying the correct write in FS filter

Hi,

I’m working on a FS filter that logs writes to a set of files, that
can be replayed if required.

If I copy a small file of size say 1000 bytes, I get two writes - one
with exactly 1000 bytes of data, and one with 4096 bytes of data with
first 1000 bytes containing the correct data followed by all zeros.
The second write has a IRP_PAGING_IO bit set.

If I ignote the write with IRP_PAGING_IO bit set, this case works
fine, but I loose almost all writes when applications like Word saves
a file.

How can I identify wheather the second type of writes should be ignored or not?

Thanks,
Hrishikesh.

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

Thanks a lot Maxim and Lydon. I’l try it out.

Hrishikesh.

On 5/7/05, Maxim S. Shatskih wrote:
> Catch only (and all) IRP_NONCACHED_IO writes. These are the real disk
> writes.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
> ----- Original Message -----
> From: “Hrishikesh Vidwans”
> To: “Windows File Systems Devs Interest List”
> Sent: Saturday, May 07, 2005 9:59 PM
> Subject: [ntfsd] Identifying the correct write in FS filter
>
> Hi,
>
> I’m working on a FS filter that logs writes to a set of files, that
> can be replayed if required.
>
> If I copy a small file of size say 1000 bytes, I get two writes - one
> with exactly 1000 bytes of data, and one with 4096 bytes of data with
> first 1000 bytes containing the correct data followed by all zeros.
> The second write has a IRP_PAGING_IO bit set.
>
> If I ignote the write with IRP_PAGING_IO bit set, this case works
> fine, but I loose almost all writes when applications like Word saves
> a file.
>
> How can I identify wheather the second type of writes should be ignored or not?
>
> Thanks,
> Hrishikesh.
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
> —
> Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>