Information on Querying a directory

Hai All,

I am trying to study the behaviour of querying a directory and I observe
the following things:

When a folder is opened in an explorer IRP_MJ_DIRECTORY_CONTROL
with FileBothDirectoryInformation as FileInformation class is being
received to my filter driver.

And If the folder contains more entries which can not be sent in one
request then there is more query requests.

when there are more number of files in directory there will be many query
requests until the status is STATUS_NO_MORE_FILES.

My question is How Does the File sytem know from which file the folder has
to be scanned for 2nd, 3rd and so on quiries.
I do not find any Index or optional name of file in the QueryDirectory of
IRP_STACK_LOCATION.

Any Information is helpful,
Thanx in advance.

Kedar.

Kedar,

Well, the only data in the IO_STACK_LOCATION
which is related to the RestartScan is the Flag
field.
When set it indicates to the FS driver that the
scan should be restarted from the X directory offset.
Now, the FS retrieve the X directory offset that has

been preserved from a previous session from its CCB
structure.

Hope that answered your question.

-Mike.

xxxxx@hotmail.com wrote:

Hai All,

I am trying to study the behaviour of querying a
directory and I observe
the following things:

When a folder is opened in an explorer
IRP_MJ_DIRECTORY_CONTROL
with FileBothDirectoryInformation as FileInformation
class is being
received to my filter driver.

And If the folder contains more entries which can
not be sent in one
request then there is more query requests.

when there are more number of files in directory
there will be many query
requests until the status is STATUS_NO_MORE_FILES.

My question is How Does the File sytem know from
which file the folder has
to be scanned for 2nd, 3rd and so on quiries.
I do not find any Index or optional name of file in
the QueryDirectory of
IRP_STACK_LOCATION.

Any Information is helpful,
Thanx in advance.

Kedar.


You are currently subscribed to ntfsd as:
xxxxx@yahoo.com
To unsubscribe send a blank email to
%%email.unsub%%


Do You Yahoo!?
Yahoo! - Official partner of 2002 FIFA World Cup
http://fifaworldcup.yahoo.com

The FileIndex filed tells where to restart.

Dejan.

Mike Malgin wrote:

Kedar,

Well, the only data in the IO_STACK_LOCATION
which is related to the RestartScan is the Flag
field.
When set it indicates to the FS driver that the
scan should be restarted from the X directory offset.
Now, the FS retrieve the X directory offset that has

been preserved from a previous session from its CCB
structure.

Hope that answered your question.

-Mike.

xxxxx@hotmail.com wrote:
> Hai All,
>
> I am trying to study the behaviour of querying a
> directory and I observe
> the following things:
>
> When a folder is opened in an explorer
> IRP_MJ_DIRECTORY_CONTROL
> with FileBothDirectoryInformation as FileInformation
> class is being
> received to my filter driver.
>
> And If the folder contains more entries which can
> not be sent in one
> request then there is more query requests.
>
> when there are more number of files in directory
> there will be many query
> requests until the status is STATUS_NO_MORE_FILES.
>
> My question is How Does the File sytem know from
> which file the folder has
> to be scanned for 2nd, 3rd and so on quiries.
> I do not find any Index or optional name of file in
> the QueryDirectory of
> IRP_STACK_LOCATION.
>
> Any Information is helpful,
> Thanx in advance.
>
> Kedar.
>
> —
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
%%email.unsub%%


Do You Yahoo!?
Yahoo! - Official partner of 2002 FIFA World Cup
http://fifaworldcup.yahoo.com


You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to %%email.unsub%%


Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32 developers.
Alfa File Protector - File protection and hiding library for Win32
developers.
Alfa Registry Monitor - Registry monitoring library for Win32
developers.
Alfa Registry Protector - Registry protection library for Win32
developers.

Hai Mike,

Thanx for your information.

Here is the context in which i have a problem.

I am writing a filter driver that intercepts and completes the
IRP_MN_QUERY_DIRECTORY request with the file entrries read from external
source instead of a local hard disk.

If an appplication queiries a directory list which has many files it will
be tranlsated to more than one IRP_MN_QUERY_DIRECTORY. Now the question is
how to keep track the directory offset for the second and so on requests.
Please note that we will not paas the IRP_MN_QUERY_DIRECTORY request to
lower FSD. However we do pass the IRP_MJ_CREATE request to lower FSD.

If we change the fields in CCB to keep tack the directory offset does it
conflict with lower file system driver.

Any Information is helpful,
Kedar.

Kedar,

Well, the only data in the IO_STACK_LOCATION
which is related to the RestartScan is the Flag
field.
When set it indicates to the FS driver that the
scan should be restarted from the X directory offset.
Now, the FS retrieve the X directory offset that has

been preserved from a previous session from its CCB
structure.

Hope that answered your question.

-Mike.

xxxxx@hotmail.com wrote:
> Hai All,
>
> I am trying to study the behaviour of querying a
> directory and I observe
> the following things:
>
> When a folder is opened in an explorer
> IRP_MJ_DIRECTORY_CONTROL
> with FileBothDirectoryInformation as FileInformation
> class is being
> received to my filter driver.
>
> And If the folder contains more entries which can
> not be sent in one
> request then there is more query requests.
>
> when there are more number of files in directory
> there will be many query
> requests until the status is STATUS_NO_MORE_FILES.
>
> My question is How Does the File sytem know from
> which file the folder has
> to be scanned for 2nd, 3rd and so on quiries.
> I do not find any Index or optional name of file in
> the QueryDirectory of
> IRP_STACK_LOCATION.
>
> Any Information is helpful,
> Thanx in advance.
>
> Kedar.
>
> —
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
%%email.unsub%%


Do You Yahoo!?
Yahoo! - Official partner of 2002 FIFA World Cup
http://fifaworldcup.yahoo.com

If you intend to complete this request on your own
and ignoring the FSD then you don’t have to
worry about the FSD current offset.
You will be better off saving your own context for
the request and using that context of yours to
handle further query directory requests.
In any case, You are not allowed to touch the CCB.

Hope that helps.

Mike

xxxxx@hotmail.com wrote:

Hai Mike,

Thanx for your information.

Here is the context in which i have a problem.

I am writing a filter driver that intercepts and
completes the
IRP_MN_QUERY_DIRECTORY request with the file
entrries read from external
source instead of a local hard disk.

If an appplication queiries a directory list which
has many files it will
be tranlsated to more than one
IRP_MN_QUERY_DIRECTORY. Now the question is
how to keep track the directory offset for the
second and so on requests.
Please note that we will not paas the
IRP_MN_QUERY_DIRECTORY request to
lower FSD. However we do pass the IRP_MJ_CREATE
request to lower FSD.

If we change the fields in CCB to keep tack the
directory offset does it
conflict with lower file system driver.

Any Information is helpful,
Kedar.

> Kedar,
>
> Well, the only data in the IO_STACK_LOCATION
> which is related to the RestartScan is the Flag
> field.
> When set it indicates to the FS driver that the
> scan should be restarted from the X directory
offset.
> Now, the FS retrieve the X directory offset that
has
>
> been preserved from a previous session from its
CCB
> structure.
>
> Hope that answered your question.
>
> -Mike.
>
> — xxxxx@hotmail.com wrote:
> > Hai All,
> >
> > I am trying to study the behaviour of querying a
> > directory and I observe
> > the following things:
> >
> > When a folder is opened in an explorer
> > IRP_MJ_DIRECTORY_CONTROL
> > with FileBothDirectoryInformation as
FileInformation
> > class is being
> > received to my filter driver.
> >
> > And If the folder contains more entries which
can
> > not be sent in one
> > request then there is more query requests.
> >
> > when there are more number of files in directory
> > there will be many query
> > requests until the status is
STATUS_NO_MORE_FILES.
> >
> > My question is How Does the File sytem know from
> > which file the folder has
> > to be scanned for 2nd, 3rd and so on quiries.
> > I do not find any Index or optional name of file
in
> > the QueryDirectory of
> > IRP_STACK_LOCATION.
> >
> > Any Information is helpful,
> > Thanx in advance.
> >
> > Kedar.
> >
> > —
> > You are currently subscribed to ntfsd as:
> > xxxxx@yahoo.com
> > To unsubscribe send a blank email to
> %%email.unsub%%
>
>
> __________________________________________________
> Do You Yahoo!?
> Yahoo! - Official partner of 2002 FIFA World Cup
> http://fifaworldcup.yahoo.com


You are currently subscribed to ntfsd as:
xxxxx@yahoo.com
To unsubscribe send a blank email to
%%email.unsub%%


Do You Yahoo!?
Yahoo! - Official partner of 2002 FIFA World Cup
http://fifaworldcup.yahoo.com

> My question is How Does the File sytem know from which file the
folder has

to be scanned for 2nd, 3rd and so on quiries.
I do not find any Index or optional name of file in the
QueryDirectory of
IRP_STACK_LOCATION.

Save the scan restart information to file’s CCB (->FsContext2).

See FASTFAT source for details. The logic is rather tricky, and bugs
are hard to find - for instance, bugs in this path can crash user mode
app in kernel32!FindNextFile.

Max