Minifilter file size query

NTFSD
1

Hi, thanks for checking out my post. I have two questions related to minifilter driver behavior during write operations:

  1. In a NonCached I/O operation where the PagingIo flag is false, will the value of Data->Iopb->Parameters.Write.Length in the PreWrite callback be sector-aligned?

  2. If I'm performing a NonCached I/O write with PagingIo set to false, what will be the value of the file size in the PreWrite stage? Specifically, will ((PFSRTL_ADVANCED_FCB_HEADER)FltObjects->FileObject->FsContext)->FileSize.QuadPart reflect the original file size before the write, or the updated size after the write?

Would appreciate any insights or clarifications. Thanks!

2

Will the value of Data->Iopb->Parameters.Write.Length in the PreWrite callback be sector-aligned?

No. If the non cached write is to the end of file or to beyond the end of file (extending write) the number can be non aligned. Or more accurately the number can be anything but the filesystem can chose to reject the write if those rules are not obeyed.

will ((PFSRTL_ADVANCED_FCB_HEADER)FltObjects->FileObject->FsContext)->FileSize.QuadPart

You do not own those fields and you can make no assumptions about them. There is no contract that states that the filesystem will keep them up to date. Send down a query and you will get the instantaneous value (bearing in mind that it can change at any time)