My first question

When a drive is formatted, I lose it’s device without
any PnP notification or WM_? Anyone know how I can
monitor drive formatting so that I can reattach to the
device stack?

Try providing some more information. What device stack? Have you watched
the ‘device stack’ and how it responds to a formatted drive and the
activities that occur during that series of events? What type of drive?

“Ric Vieler” wrote in message news:xxxxx@ntfsd…
> When a drive is formatted, I lose it’s device without
> any PnP notification or WM_? Anyone know how I can
> monitor drive formatting so that I can reattach to the
> device stack?
>

You do not lose any devices (except the filesystem’s volume device object)
due to FORMAT.

Quick FORMAT is:

  1. open the volume blockwise
  2. send FSCTL_LOCK_VOLUME. This prevents any other party from accessing the
    volume, and fails if there are already open files on it.
  3. write the empty volume’s metadata by hand from user mode (UNTFS.DLL or
    FORMAT.COM)
  4. send FSCTL_DISMOUNT_VOLUME. This detaches the old FSD’s device object
    and related structures (which are no more matching the real on-disk data) from
    the disk device object.
  5. send FSCTL_UNLOCK_VOLUME, then close the volume handle. This (one of
    these operations) destroy the old in-memory FSD’s device object and related
    structures.
  6. the new volume will be mounted, and the new FSD’s device object and
    related structures created only when the next app will try to open any files on
    the volume. This can occur anytime from point 4 up.

Full FORMAT is the same but with additional step 2A after 2 - send
IOCTL_DISK_VERIFY in a loop for all sectors.

There are no ways of catching the volume formatting. For security reasons,
you can catch the blockwise volume opens instead - this also catches CHKDSK /F
and some 3rd party disk tools.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Ric Vieler”
To: “Windows File Systems Devs Interest List”
Sent: Saturday, April 01, 2006 5:26 AM
Subject: [ntfsd] My first question

> When a drive is formatted, I lose it’s device without
> any PnP notification or WM_? Anyone know how I can
> monitor drive formatting so that I can reattach to the
> device stack?