Is there a way to find out pending write on a file

NTFSD
1

Hi,

In our encryption software we have a mini filter with a user mode application which performs some necessary task during read & write processing.

If user has an dirty file open in any application & press restart, Application ask user to save the data & when user say yes; application get closed. Our user mdoe application also get closed as normal shutdown processing. Later on filter receives paging write request & tries to connect with user mode exe. Filter when found that user mode exe is not up; deny the paging write request which cause data corruption at disk.

When user initiates a shutdown all user mode applications receives a WM_QUERY_ENDSESSION; in which they can resume or halt the shutdown operation. But what should be the base of that decision i.e. how can it knows that some write is still pending on a particular file. We have tried by maintaining a counter at user mode & increment it when filter receives create with write access & decrement it on corresponding close. This approach fails as many applications open file with write access even if write is not intended.

2

Some more information.

We also tried to increment the user mode counter when we receives the first write request on a file object (Obviously we maintain that it happens only once in spite of many write requests until close on same file object receives which decrement the counter).we have seen that paging write some times come on a different file object which in fact was not opened with write permission & the file object on which write was initiated get closed before this.

We ensure that our user mode application is last to receives query_end_session message.(using SetProcessShutdownParameters API)

Thanks for your patience.
Aditya

3

Use the service instead of the app.

–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

wrote in message news:xxxxx@ntfsd…
> Hi,
>
> In our encryption software we have a mini filter with a user mode application
which performs some necessary task during read & write processing.
>
> If user has an dirty file open in any application & press restart,
Application ask user to save the data & when user say yes; application get
closed. Our user mdoe application also get closed as normal shutdown
processing. Later on filter receives paging write request & tries to connect
with user mode exe. Filter when found that user mode exe is not up; deny the
paging write request which cause data corruption at disk.
>
> When user initiates a shutdown all user mode applications receives a
WM_QUERY_ENDSESSION; in which they can resume or halt the shutdown operation.
But what should be the base of that decision i.e. how can it knows that some
write is still pending on a particular file. We have tried by maintaining a
counter at user mode & increment it when filter receives create with write
access & decrement it on corresponding close. This approach fails as many
applications open file with write access even if write is not intended.
>

4

Thanks Maxim.

But It is not feasible for us as we maintain individual application on per user(logged in) basis. If there is any way to track the thing(any write is expected) either at filter level or with user mode than it will really help.