Obtain Info on Mapping a File upon a Hard Disk?

NTFSD
1

Hi, every one,

In the kernel mode, it is possible to catch all accesses(read and write) to
a mounted volume (here referred to as a hard disk) via a file system file
filter. In the user mode, the OS and application may update information on a
volume concurrently. However, any user-mode application has no way to peep
at the OS behavior on a volume. That means the file filter may be a only
solution. Regarding of the data structure of NTFS, some concepts such as
File Control Block and Master File Table are useful. Obviously, FAT differs
from NTFS in this point. To get portability, we can directly get the
physical offset and length of a file on a hard disk via some kind of file
filter.

My question is
how to get the mapping of a file from the virtual memory space onto the
physical space on a hard disk or directly get its physical storage
information on a disk in the kernel mode?

Appreciate any suggestions.

-Yuzhong

This email has been scanned for all viruses by the MessageLabs SkyScan
service. For more information on a proactive anti-virus service working
around the clock, around the globe, visit http://www.messagelabs.com

2

>how to get the mapping of a file from the virtual memory space onto the

physical space on a hard disk or directly get its physical storage
information on a disk in the kernel mode?

FSCTL_GET_RETRIEVAL_POINTERS provides information where data of a
particular file are located on the disk.

Alexei.

3

You assume there is a one-to-one mapping between a file system instance and
the underlying disk media. Keep in mind that in fact this is a one-to-many
relationship, and thus a single file might actually be striped across
multiple partitions on multiple disk drives.

Any design that ignores this possibility is inherently flawed.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: Yuzhong Sun [mailto:xxxxx@tapeware.com]
Sent: Wednesday, February 19, 2003 2:50 PM
To: File Systems Developers
Subject: [ntfsd] Obtain Info on Mapping a File upon a Hard Disk?

Hi, every one,

In the kernel mode, it is possible to catch all accesses(read and write) to
a mounted volume (here referred to as a hard disk) via a file system file
filter. In the user mode, the OS and application may update information on a
volume concurrently. However, any user-mode application has no way to peep
at the OS behavior on a volume. That means the file filter may be a only
solution. Regarding of the data structure of NTFS, some concepts such as
File Control Block and Master File Table are useful. Obviously, FAT differs
from NTFS in this point. To get portability, we can directly get the
physical offset and length of a file on a hard disk via some kind of file
filter.

My question is
how to get the mapping of a file from the virtual memory space onto the
physical space on a hard disk or directly get its physical storage
information on a disk in the kernel mode?

Appreciate any suggestions.

-Yuzhong

This email has been scanned for all viruses by the MessageLabs SkyScan
service. For more information on a proactive anti-virus service working
around the clock, around the globe, visit http://www.messagelabs.com

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

Hi, Alexei,

I must use it in the kernel mode? I tried some other control codes in the
user mode. But, I failed.

Appreciate any help.

-Yuzhong

-----Original Message-----
From: Alexei Jelvis [mailto:xxxxx@rogers.com]
Sent: Wednesday, February 19, 2003 6:45 PM
To: File Systems Developers
Subject: [ntfsd] Re: Obtain Info on Mapping a File upon a Hard Disk?

how to get the mapping of a file from the virtual memory space onto the
physical space on a hard disk or directly get its physical storage
information on a disk in the kernel mode?

FSCTL_GET_RETRIEVAL_POINTERS provides information where data of a
particular file are located on the disk.

Alexei.

You are currently subscribed to ntfsd as: xxxxx@tapeware.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

This email has been scanned for all viruses by the MessageLabs SkyScan
service. For more information on a proactive anti-virus service working
around the clock, around the globe, visit http://www.messagelabs.com

This email has been scanned for all viruses by the MessageLabs SkyScan
service. For more information on a proactive anti-virus service working
around the clock, around the globe, visit http://www.messagelabs.com

5

See http://www.sysinternals.com/ntw2k/info/defrag.shtml

Don Burn
Windows 2k/XP/2k3 Filesystem and Driver Consulting

----- Original Message -----
From: “Yuzhong Sun”
To: “File Systems Developers”
Sent: Monday, February 24, 2003 1:00 PM
Subject: [ntfsd] Re: Obtain Info on Mapping a File upon a Hard Disk?

> Hi, Alexei,
>
> I must use it in the kernel mode? I tried some other control codes in the
> user mode. But, I failed.
>
> Appreciate any help.
>
> -Yuzhong
>
> -----Original Message-----
> From: Alexei Jelvis [mailto:xxxxx@rogers.com]
> Sent: Wednesday, February 19, 2003 6:45 PM
> To: File Systems Developers
> Subject: [ntfsd] Re: Obtain Info on Mapping a File upon a Hard Disk?
>
>
> >how to get the mapping of a file from the virtual memory space onto the
> >physical space on a hard disk or directly get its physical storage
> >information on a disk in the kernel mode?
>
> FSCTL_GET_RETRIEVAL_POINTERS provides information where data of a
> particular file are located on the disk.
>
> Alexei.
>
> —
> You are currently subscribed to ntfsd as: xxxxx@tapeware.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
> This email has been scanned for all viruses by the MessageLabs SkyScan
> service. For more information on a proactive anti-virus service working
> around the clock, around the globe, visit http://www.messagelabs.com
>
>
>
> This email has been scanned for all viruses by the MessageLabs SkyScan
> service. For more information on a proactive anti-virus service working
> around the clock, around the globe, visit http://www.messagelabs.com
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@acm.org
> To unsubscribe send a blank email to xxxxx@lists.osr.com