The file system filter driver I built after studying Filemon used
fileObjects for tracking open files of interest. After *much* reading, I
see that it is better to use the FsContext field of the fileObject. I’m
checking this in my create completion routine but occasionally am seeing a
NULL value after the create completes. Under what conditions might this
happen? How can I be sure to get a valid FCB for each create call…
TIA,
Bill
Doh! (I hate when I can answer my own questions.) The obvious answer is:
FILE_NOT_FOUND. Some DbgPrints show that this happens on CREATE calls to
a previously non-existant temp file opened by the app whose reads I’m
filtering. Sorry to use up the bandwidth…
There is also a possibility of not getting the FCB in a successful call -
though rare. Consider RAW FS.
Also, some 3rd party FSes might be different.
Bill wrote:
Doh! (I hate when I can answer my own questions.) The obvious answer is:
FILE_NOT_FOUND. Some DbgPrints show that this happens on CREATE calls to
a previously non-existant temp file opened by the app whose reads I’m
filtering. Sorry to use up the bandwidth…
You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to %%email.unsub%%
–
Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32 developers.
Alfa File Protector - File protection and hiding library for Win32 developers.