IoCreateStreamFileObject question

NTFSD
1

In my filter driver, I sometimes see operations against previously unknown
fileObjects (those fabricated by the FSD via IoCreateStreamFileObject()
and its kin). I am handling these in my tracking OK, but I don’t
understand why the FSD does this sometimes but not others.

Under what conditions would the FSD need to create a fabricated fileObject
when, in other circumstances, it does not?

Thanks,
Bill

2

It depends on the FSD implementation. NTFS uses stream fileobjects to
initialize caching for a given file, this is why you see the paging
utilize the SFO’s.

Pete

Peter Scott
xxxxx@KernelDrivers.com
www.KernelDrivers.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Bill
Sent: Tuesday, August 19, 2003 12:14 PM
To: File Systems Developers
Subject: [ntfsd] IoCreateStreamFileObject question

In my filter driver, I sometimes see operations against previously
unknown
fileObjects (those fabricated by the FSD via IoCreateStreamFileObject()
and its kin). I am handling these in my tracking OK, but I don’t
understand why the FSD does this sometimes but not others.

Under what conditions would the FSD need to create a fabricated
fileObject
when, in other circumstances, it does not?

Thanks,
Bill

You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Thanks, Pete. I had gathered that already. The system I am testing on is
NTFS. Sometimes I see this affect and sometimes I don’t. In order to
manufacture a test case where I can see fabricated fileObjects “on
demand”, I need to know what the circumstances are that cause this for one
set of file ops but not for another.

It depends on the FSD implementation. NTFS uses stream fileobjects to
initialize caching for a given file, this is why you see the paging
utilize the SFO’s.

Pete

4

I haven’t looked into the exact criteria that must be met in order for
NTFS to utilize a stream FO for cache initialization but it wouldn’t be
too hard to determine when this does occur. It may take some time
setting up some bp’s in the NTFS read and write handlers along with some
around the CreateStreamFO routine but then it’s a matter of looking
through the assembly.

Probably not what you wanted to hear but there maybe someone else who
has determined these criteria who could help.

Pete

Peter Scott
xxxxx@KernelDrivers.com
www.KernelDrivers.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Bill
Sent: Wednesday, August 20, 2003 8:12 AM
To: File Systems Developers
Subject: [ntfsd] RE: IoCreateStreamFileObject question

Thanks, Pete. I had gathered that already. The system I am testing on
is
NTFS. Sometimes I see this affect and sometimes I don’t. In order to
manufacture a test case where I can see fabricated fileObjects “on
demand”, I need to know what the circumstances are that cause this for
one
set of file ops but not for another.

It depends on the FSD implementation. NTFS uses stream fileobjects to
initialize caching for a given file, this is why you see the paging
utilize the SFO’s.

Pete

You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com
To unsubscribe send a blank email to xxxxx@lists.osr.com