Missing files

Hi All,

I’ve encountered with some very strange things…

I’m running an application that writes (IRP_MJ_WRITE) files
(with STATUS_SUCCESS) that my filter driver monitors (and so does the
filemonitor).
However, nothing is being written to the harddisk.

I checked for both flags, FO_TEMPORARY_FILE and FO_DELETE_ON_CLOSE
in the file object, but they weren’t defined.

Any ideas ?

thanks,
Guy.


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

Guy,

When you say “nothing is being written to the harddisk” do you mean "nothing
is written to the hard disk between the time the IRP_MJ_WRITE is sent to the
FSD and returns, or do you mean “I watched and nothing was written to the
hard disk any time in the next 20 minutes.”

I ask because NTFS and FAT implement write-behind caching (except when it is
disabled for some reason) and if you are expecting synchronous write
behavior, you will be disappointed.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com
?
Hope to see you at the next OSR file systems class March 11, 2002 in Boston!

-----Original Message-----
From: xxxxx@hotmail.com [mailto:xxxxx@hotmail.com]
Sent: Wednesday, February 13, 2002 4:26 AM
To: File Systems Developers
Subject: [ntfsd] Missing files

Hi All,

I’ve encountered with some very strange things…

I’m running an application that writes (IRP_MJ_WRITE) files
(with STATUS_SUCCESS) that my filter driver monitors (and so does the
filemonitor).
However, nothing is being written to the harddisk.

I checked for both flags, FO_TEMPORARY_FILE and FO_DELETE_ON_CLOSE
in the file object, but they weren’t defined.

Any ideas ?

thanks,
Guy.


You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

Tony,

  1. I’m running on FAT
  2. I have a disk driver that monitors every read/write to the disk,
    and it doesn’t get any notification for those files I’ve mentioned
    (up to the completion of the dismount procedure for that disk).

Could that possibly be ?

Btw, say that i’m interested only with files that are actually written to
the disk, would monitoring of paging io calls be sufficient ?

Thanks,
Guy.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Tony Mason
Sent: Wed, February 13, 2002 4:59 PM
To: File Systems Developers
Subject: [ntfsd] RE: Missing files

Guy,

When you say “nothing is being written to the harddisk” do you mean "nothing
is written to the hard disk between the time the IRP_MJ_WRITE is sent to the
FSD and returns, or do you mean “I watched and nothing was written to the
hard disk any time in the next 20 minutes.”

I ask because NTFS and FAT implement write-behind caching (except when it is
disabled for some reason) and if you are expecting synchronous write
behavior, you will be disappointed.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com
?
Hope to see you at the next OSR file systems class March 11, 2002 in Boston!

-----Original Message-----
From: xxxxx@hotmail.com [mailto:xxxxx@hotmail.com]
Sent: Wednesday, February 13, 2002 4:26 AM
To: File Systems Developers
Subject: [ntfsd] Missing files

Hi All,

I’ve encountered with some very strange things…

I’m running an application that writes (IRP_MJ_WRITE) files
(with STATUS_SUCCESS) that my filter driver monitors (and so does the
filemonitor).
However, nothing is being written to the harddisk.

I checked for both flags, FO_TEMPORARY_FILE and FO_DELETE_ON_CLOSE
in the file object, but they weren’t defined.

Any ideas ?

thanks,
Guy.


You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: xxxxx@exent.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

Guy,

Hmm. What do you mean by “[I]t doesn’t get any notification for those files
I’ve mentioned…” Are you looking at IRPs from the FAT file system trying
to find the file object for the file ABOVE the file system? If so, that
information isn’t going to be present in those write IRPs from the FAT file
system.

Monitoring paging I/O is not sufficient. You need to monitor all non-cached
I/O. That catches both paging I/O and user-level non-cached I/O operations.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com
?
Hope to see you at the next OSR file systems class March 11, 2002 in Boston!

-----Original Message-----
From: Amir kedan [mailto:xxxxx@exent.com]
Sent: Wednesday, February 13, 2002 10:29 AM
To: File Systems Developers
Subject: [ntfsd] RE: Missing files

Tony,

  1. I’m running on FAT
  2. I have a disk driver that monitors every read/write to the disk,
    and it doesn’t get any notification for those files I’ve mentioned
    (up to the completion of the dismount procedure for that disk).

Could that possibly be ?

Btw, say that i’m interested only with files that are actually written to
the disk, would monitoring of paging io calls be sufficient ?

Thanks,
Guy.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Tony Mason
Sent: Wed, February 13, 2002 4:59 PM
To: File Systems Developers
Subject: [ntfsd] RE: Missing files

Guy,

When you say “nothing is being written to the harddisk” do you mean "nothing
is written to the hard disk between the time the IRP_MJ_WRITE is sent to the
FSD and returns, or do you mean “I watched and nothing was written to the
hard disk any time in the next 20 minutes.”

I ask because NTFS and FAT implement write-behind caching (except when it is
disabled for some reason) and if you are expecting synchronous write
behavior, you will be disappointed.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com
?
Hope to see you at the next OSR file systems class March 11, 2002 in Boston!

-----Original Message-----
From: xxxxx@hotmail.com [mailto:xxxxx@hotmail.com]
Sent: Wednesday, February 13, 2002 4:26 AM
To: File Systems Developers
Subject: [ntfsd] Missing files

Hi All,

I’ve encountered with some very strange things…

I’m running an application that writes (IRP_MJ_WRITE) files
(with STATUS_SUCCESS) that my filter driver monitors (and so does the
filemonitor).
However, nothing is being written to the harddisk.

I checked for both flags, FO_TEMPORARY_FILE and FO_DELETE_ON_CLOSE
in the file object, but they weren’t defined.

Any ideas ?

thanks,
Guy.


You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: xxxxx@exent.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com