IOCTL for Stopping writes to disk/volume but reads should continue

NTFSD
1

Hi Everyone,
I was trying to build an sample test application in which i wanted to achieve stopping of I/O’s to disk/volume with read’s still being continued.
I have tried using IOCTL - FSCTL_LOCL_VOLUME and by flushing file buffers with FlushFileBuffers() method. But,I observe that writes are still happening to the volume.

  • If in case i use volume label name like “E:\” with IOCTL FSCTL_LOCL_VOLUME i observe that file system is getting dismounted ending up with no access to operating system (“Access denied error”).

  • Please let me know if i am doing this correctly and it can be done with user mode application. Instead of making changes in driver to do the same.

Here is snippet of my code:

hVolume = CreateFile(_T(“\\.\PhysicalDrive2”), // File name or device name (used disk)
GENERIC_READ | GENERIC_WRITE, // Desired file access
FILE_SHARE_READ | FILE_SHARE_WRITE, // Sharing mode
NULL, // Default security attributes
OPEN_EXISTING, // Opens only if it exists
0, // File attributes
NULL); // Do not copy file attributes

if (hVolume == INVALID_HANDLE_VALUE) // we can’t open the drive
{
printf(“INVALID_HANDLE for volume %ld.\n”,GetLastError ());
return (FALSE);
}

FlushFileBuffers(hVolume);

bLocked = DeviceIoControl(
hVolume, // handle to a volume
FSCTL_LOCK_VOLUME, // dwIoControlCode
NULL, // lpInBuffer
0, // nInBufferSize
NULL, // lpOutBuffer
0, // nOutBufferSize
&bytesReturned, // number of bytes returned
NULL // OVERLAPPED structure
);

2

Disks and volume are not the same thing…Are you trying to do this at the
disk or volume level?

Also, what is your ultimate goal? I understand that you have found yourself
in a situation where you want to temporarily make a volume read only, but
why? The motivation might lead to different answers.

-scott
OSR
@OSRDrivers

wrote in message news:xxxxx@ntfsd…

Hi Everyone,
I was trying to build an sample test application in which
i wanted to achieve stopping of I/O’s to disk/volume with read’s still being
continued.
I have tried using IOCTL - FSCTL_LOCL_VOLUME and by flushing file buffers
with FlushFileBuffers() method. But,I observe that writes are still
happening to the volume.

  • If in case i use volume label name like “E:\” with IOCTL
    FSCTL_LOCL_VOLUME i observe that file system is getting dismounted ending up
    with no access to operating system (“Access denied error”).

  • Please let me know if i am doing this correctly and it can be done with
    user mode application. Instead of making changes in driver to do the same.

Here is snippet of my code:

hVolume = CreateFile(_T(“\\.\PhysicalDrive2”), // File name or device
name (used disk)
GENERIC_READ | GENERIC_WRITE, // Desired file access
FILE_SHARE_READ | FILE_SHARE_WRITE, // Sharing mode
NULL, // Default security attributes
OPEN_EXISTING, // Opens only if it exists
0, // File attributes
NULL); // Do not copy file attributes

if (hVolume == INVALID_HANDLE_VALUE) // we can’t open the drive
{
printf(“INVALID_HANDLE for volume %ld.\n”,GetLastError ());
return (FALSE);
}

FlushFileBuffers(hVolume);

bLocked = DeviceIoControl(
hVolume, // handle to a volume
FSCTL_LOCK_VOLUME, // dwIoControlCode
NULL, // lpInBuffer
0, // nInBufferSize
NULL, // lpOutBuffer
0, // nOutBufferSize
&bytesReturned, // number of bytes returned
NULL // OVERLAPPED structure
);

3

Hi Scott,
I wanted to do at volume level as the way VSS does freeze and thaw of volumes for creation of snapshot.
My goal is to create a sample application where in which flush and stop the IO writes to volume with reads only enabled.

Thanks

4

Why not just create a VSS snapshot? It’s not that much code and then you
have a stable view to read from.

-scott
OSR
@OSRDrivers

wrote in message news:xxxxx@ntfsd…

Hi Scott,
I wanted to do at volume level as the way VSS does freeze and thaw of
volumes for creation of snapshot.
My goal is to create a sample application where in which flush and stop
the IO writes to volume with reads only enabled.

Thanks