if file modified in IRP_MJ_CLEANUP?

NTFSD
1

Hi,

I need to know if a file has been modified since it was opened, when its going to be closed. I have tried to check for FO_FILE_MODIFIED in FILE_OBJECT->Flags, but it seems to not work correctly.

Besides checking for WRITE requests and having a table that keeps track of file changes, is there a way to know if the file has been modified?

Best Wishes,
Arman Nayyeri

2

Hi!

I need to know if a file has been modified since it was opened, when its
going to be closed. I have tried to check for FO_FILE_MODIFIED in
FILE_OBJECT->Flags, but it seems to not work correctly.

AFAIK, Microsoft does not recommend checking this flag. And ya, this does not work properly.

Besides checking for WRITE requests and having a table that keeps track >of file changes, is there a way to know if the file has been modified?

Merely checking for WRITE requests is not sufficient. What about SetInformation?

Regards,
Ayush Gupta

Add more friends to your messenger and enjoy! Go to http://messenger.yahoo.com/invite/

3

You could record the LastWriteTime in post-create and compare it to
LastWriteTime in post-cleanup (maybe size, too). That will tell you if it
was written.

However, as already mentioned, you must also watch SetInformation for things
like Rename or Delete (or changing LastWriteTime).

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Thursday, January 08, 2009 8:48 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] if file modified in IRP_MJ_CLEANUP?

Hi,

I need to know if a file has been modified since it was opened, when its
going to be closed. I have tried to check for FO_FILE_MODIFIED in
FILE_OBJECT->Flags, but it seems to not work correctly.

Besides checking for WRITE requests and having a table that keeps track of
file changes, is there a way to know if the file has been modified?

Best Wishes,
Arman Nayyeri

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

Hello Arman Nayyeri,
You should look for NON Cached requests that may modify the file. Track the file down in create, and when a set information or write occurs (paging or non cached) mark the file as dirty.
As far as I know after the CLEANUP occurs you cannot modify the file anymore.
This would be the procedure I guess. This is what I am using and it works fine.
Good luck.

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Ayush Gupta
Sent: Friday, January 09, 2009 9:51 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] if file modified in IRP_MJ_CLEANUP?

Hi!

I need to know if a file has been modified since it was opened, when its
going to be closed. I have tried to check for FO_FILE_MODIFIED in
FILE_OBJECT->Flags, but it seems to not work correctly.

AFAIK, Microsoft does not recommend checking this flag. And ya, this does not work properly.

Besides checking for WRITE requests and having a table that keeps track >of file changes, is there a way to know if the file has been modified?

Merely checking for WRITE requests is not sufficient. What about SetInformation?

Regards,
Ayush Gupta

Add more friends to your messenger and enjoy! Go to http://messenger.yahoo.com/invite/

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

>As far as I know after the CLEANUP occurs you cannot modify the file

anymore.

What about paging I/O? As an example, it’s pretty common to open a file,
memory map it, and then close the file handle. You’ll see a cleanup, but the
application can still modify the file via the mapping.

-scott

–
Scott Noone
Software Engineer
OSR Open Systems Resources, Inc.
http://www.osronline.com

“Bercea Gabriel” wrote in message news:xxxxx@ntfsd…
Hello Arman Nayyeri,
You should look for NON Cached requests that may modify the file. Track the
file down in create, and when a set information or write occurs (paging or
non cached) mark the file as dirty.
As far as I know after the CLEANUP occurs you cannot modify the file
anymore.
This would be the procedure I guess. This is what I am using and it works
fine.
Good luck.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ayush Gupta
Sent: Friday, January 09, 2009 9:51 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] if file modified in IRP_MJ_CLEANUP?

Hi!

>I need to know if a file has been modified since it was opened, when its
>going to be closed. I have tried to check for FO_FILE_MODIFIED in
>FILE_OBJECT->Flags, but it seems to not work correctly.

AFAIK, Microsoft does not recommend checking this flag. And ya, this does
not work properly.

>Besides checking for WRITE requests and having a table that keeps track >of
>file changes, is there a way to know if the file has been modified?

Merely checking for WRITE requests is not sufficient. What about
SetInformation?

Regards,
Ayush Gupta

Add more friends to your messenger and enjoy! Go to
http://messenger.yahoo.com/invite/

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

6

That is something else
The FS will spawn a stream FO and will the memory commit on that. You will
see with file spy that the cleanup will be shortly accompanied by the close
and the file is still modified by the MM.
Check for Acquire for section synch.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Scott Noone
Sent: Friday, January 09, 2009 5:10 PM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] if file modified in IRP_MJ_CLEANUP?

As far as I know after the CLEANUP occurs you cannot modify the file
anymore.

What about paging I/O? As an example, it’s pretty common to open a file,
memory map it, and then close the file handle. You’ll see a cleanup, but the

application can still modify the file via the mapping.

-scott

–
Scott Noone
Software Engineer
OSR Open Systems Resources, Inc.
http://www.osronline.com

“Bercea Gabriel” wrote in message news:xxxxx@ntfsd…
Hello Arman Nayyeri,
You should look for NON Cached requests that may modify the file. Track the
file down in create, and when a set information or write occurs (paging or
non cached) mark the file as dirty.
As far as I know after the CLEANUP occurs you cannot modify the file
anymore.
This would be the procedure I guess. This is what I am using and it works
fine.
Good luck.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ayush Gupta
Sent: Friday, January 09, 2009 9:51 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] if file modified in IRP_MJ_CLEANUP?

Hi!

>I need to know if a file has been modified since it was opened, when its
>going to be closed. I have tried to check for FO_FILE_MODIFIED in
>FILE_OBJECT->Flags, but it seems to not work correctly.

AFAIK, Microsoft does not recommend checking this flag. And ya, this does
not work properly.

>Besides checking for WRITE requests and having a table that keeps track >of

>file changes, is there a way to know if the file has been modified?

Merely checking for WRITE requests is not sufficient. What about
SetInformation?

Regards,
Ayush Gupta

Add more friends to your messenger and enjoy! Go to
http://messenger.yahoo.com/invite/

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@gmail.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

7

> The FS will spawn a stream FO and will the memory commit on that. You will

see with file spy that the cleanup will be shortly accompanied by the
close
and the file is still modified by the MM.

Isn’t that FS specific behavior? I have an app that does forces this
condition (needed it to track down a specific problem in the DMK) and I see
what you describe for NTFS and what I describe for FAT (create, cleanup,
write, close).

Granted it could be different for different versions, but it’s possible.

-scott

–
Scott Noone
Software Engineer
OSR Open Systems Resources, Inc.
http://www.osronline.com

“Bercea Gabriel” wrote in message news:xxxxx@ntfsd…
> That is something else
> The FS will spawn a stream FO and will the memory commit on that. You will
> see with file spy that the cleanup will be shortly accompanied by the
> close
> and the file is still modified by the MM.
> Check for Acquire for section synch.
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Scott Noone
> Sent: Friday, January 09, 2009 5:10 PM
> To: Windows File Systems Devs Interest List
> Subject: Re:[ntfsd] if file modified in IRP_MJ_CLEANUP?
>
>>As far as I know after the CLEANUP occurs you cannot modify the file
>>anymore.
>
> What about paging I/O? As an example, it’s pretty common to open a file,
> memory map it, and then close the file handle. You’ll see a cleanup, but
> the
>
> application can still modify the file via the mapping.
>
> -scott
>
> –
> Scott Noone
> Software Engineer
> OSR Open Systems Resources, Inc.
> http://www.osronline.com
>
>
> “Bercea Gabriel” wrote in message news:xxxxx@ntfsd…
> Hello Arman Nayyeri,
> You should look for NON Cached requests that may modify the file. Track
> the
> file down in create, and when a set information or write occurs (paging or
> non cached) mark the file as dirty.
> As far as I know after the CLEANUP occurs you cannot modify the file
> anymore.
> This would be the procedure I guess. This is what I am using and it works
> fine.
> Good luck.
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Ayush Gupta
> Sent: Friday, January 09, 2009 9:51 AM
> To: Windows File Systems Devs Interest List
> Subject: Re: [ntfsd] if file modified in IRP_MJ_CLEANUP?
>
> Hi!
>
>>I need to know if a file has been modified since it was opened, when its
>>going to be closed. I have tried to check for FO_FILE_MODIFIED in
>>FILE_OBJECT->Flags, but it seems to not work correctly.
>
> AFAIK, Microsoft does not recommend checking this flag. And ya, this does
> not work properly.
>
>>Besides checking for WRITE requests and having a table that keeps track
>> >of
>
>>file changes, is there a way to know if the file has been modified?
>
> Merely checking for WRITE requests is not sufficient. What about
> SetInformation?
>
> Regards,
> Ayush Gupta
>
>
> Add more friends to your messenger and enjoy! Go to
> http://messenger.yahoo.com/invite/
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>

8

Scott Noone wrote:

> The FS will spawn a stream FO and will the memory commit on that. You will
> see with file spy that the cleanup will be shortly accompanied by the
> close
> and the file is still modified by the MM.

Isn’t that FS specific behavior? I have an app that does forces this
condition (needed it to track down a specific problem in the DMK) and I see
what you describe for NTFS and what I describe for FAT (create, cleanup,
write, close).

Granted it could be different for different versions, but it’s possible.

Remember also that you may not be looking at the file object which was
used to initialize the section, which is the one you will finally see
the IRP_MJ_CLOSE against. Thus the file object you see the
IRP_MJ_CLEANUP on may not be the above file object and hence the close
will follow on this file object.

Again, as Scott indicated, this is file system specific. NTFS and FAT do
cache initialization using different methods.

Pete

-scott

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295

9

> Hello Arman Nayyeri,

You should look for NON Cached requests that may modify the file. Track the file
down in create, and when a set information or write occurs (paging or non
cached) mark the file as dirty.
As far as I know after the CLEANUP occurs you cannot modify the file anymore.
This would be the procedure I guess. This is what I am using and it works fine.
Good luck.

its all cleared up now. I should track the file in Write and SetInformation, that way i will know if the file has been changed in CLEANUP.

thanks all