Offline files/CSC disablement?

NTFSD
1

Hey all,

Has anyone figured out how to essentially not let a file/dir get set for
offline file access? I have a case where I don’t want to let certain files
over the SMB redirector be used in offline mode. I’ve scoured the net, but
can’t find any documentation about the IOCTLs involved in CSC (offline
files). If anyone has worked with this before, it would be a big help if
you could point me in the direction of some docs.

Everything is fine if I disable it for the whole computer, but I can’t seem
to find how to disable it on specific files/dirs.

Thanks,
Matt

2

Control Panel/Folder options/Offline Files/Enable Offline files.

There’s no method known to me how you can disable
offline files selectively. Of course unless you will be filtering
CSC IOCTLs for that particular directory and deny them.

The IOCTLs for offline files are not documented. You may observe them
with FileSpy, as I’ve dealt with offline files before and have included
them into the FileSpy’s IOCTL decoder. This is their list:

//
// Undocumented IOCTLs (mrxsmb.sys)
// The names might not be correct, because they are derived
// from the names of functions in MrsSmb.sys which are called
//

case 0x140FAF : return _T(“IOCTL_GET_UNC_PATH”);
case 0x140FB3 : return _T(“IOCTL_BEGIN_PQ_ENUM”);
case 0x140FB7 : return _T(“IOCTL_END_PQ_ENUM”);
case 0x140FBB : return _T(“IOCTL_NEXT_PRI_SHADOW”);
case 0x140FC3 : return _T(“IOCTL_GET_SHADOW_INFO”);
case 0x140FC7 : return _T(“IOCTL_CSC_SET_SHADOW_INFO”);
case 0x140FCB : return _T(“IOCTL_CSC_CHECK_UPDATE_STATUS”);
case 0x140FCF : return _T(“IOCTL_CSC_DO_SHADOW_MAINTENANCE”);
case 0x140FD3 : return _T(“IOCTL_CSC_COPY_CHUNK”);
case 0x140FE7 : return _T(“IOCTL_GET_SHARE_STATUS”);
case 0x140FFB : return _T(“IOCTL_CSC_SWITCHES”);
case 0x140FFF : return _T(“IOCTL_CSC_CHECK_FOR_NULLW”);
case 0x141003 : return _T(“IOCTL_CSC_GET_GLOBAL_STATUS”);
case 0x141007 : return _T(“IOCTL_CSC_FIND_OPEN_HSHADOW”);
case 0x14100B : return _T(“IOCTL_CSC_FIND_NEXT_HSHADOW”);
case 0x14100F : return _T(“IOCTL_CSC_FIND_CLOSE_HSHADOW”);
case 0x141043 : return _T(“IOCTL_CSC_OPEN_FOR_COPY_CHUNK”);
case 0x141047 : return _T(“IOCTL_CSC_CLOSE_FOR_COPY_CHUNK”);
case 0x14104B : return _T(“IOCTL_CSC_IS_SERVER_OFFLINE”);

L.

3

Thanks L. But is there any real way to determine which file/dir the IOCTL
is being called on without knowing the format of the IOCTL?

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ladislav Zezula
Sent: Sunday, August 06, 2006 2:58 PM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] Offline files/CSC disablement?

Control Panel/Folder options/Offline Files/Enable Offline files.

There’s no method known to me how you can disable offline files selectively.
Of course unless you will be filtering CSC IOCTLs for that particular
directory and deny them.

The IOCTLs for offline files are not documented. You may observe them with
FileSpy, as I’ve dealt with offline files before and have included them into
the FileSpy’s IOCTL decoder. This is their list:

//
// Undocumented IOCTLs (mrxsmb.sys)
// The names might not be correct, because they are derived
// from the names of functions in MrsSmb.sys which are called
//

case 0x140FAF : return _T(“IOCTL_GET_UNC_PATH”);
case 0x140FB3 : return _T(“IOCTL_BEGIN_PQ_ENUM”);
case 0x140FB7 : return _T(“IOCTL_END_PQ_ENUM”);
case 0x140FBB : return _T(“IOCTL_NEXT_PRI_SHADOW”);
case 0x140FC3 : return _T(“IOCTL_GET_SHADOW_INFO”);
case 0x140FC7 : return _T(“IOCTL_CSC_SET_SHADOW_INFO”);
case 0x140FCB : return _T(“IOCTL_CSC_CHECK_UPDATE_STATUS”);
case 0x140FCF : return _T(“IOCTL_CSC_DO_SHADOW_MAINTENANCE”);
case 0x140FD3 : return _T(“IOCTL_CSC_COPY_CHUNK”);
case 0x140FE7 : return _T(“IOCTL_GET_SHARE_STATUS”);
case 0x140FFB : return _T(“IOCTL_CSC_SWITCHES”);
case 0x140FFF : return _T(“IOCTL_CSC_CHECK_FOR_NULLW”);
case 0x141003 : return _T(“IOCTL_CSC_GET_GLOBAL_STATUS”);
case 0x141007 : return _T(“IOCTL_CSC_FIND_OPEN_HSHADOW”);
case 0x14100B : return _T(“IOCTL_CSC_FIND_NEXT_HSHADOW”);
case 0x14100F : return _T(“IOCTL_CSC_FIND_CLOSE_HSHADOW”);
case 0x141043 : return _T(“IOCTL_CSC_OPEN_FOR_COPY_CHUNK”);
case 0x141047 : return _T(“IOCTL_CSC_CLOSE_FOR_COPY_CHUNK”);
case 0x14104B : return _T(“IOCTL_CSC_IS_SERVER_OFFLINE”);

L.

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@bitarmor.com To unsubscribe
send a blank email to xxxxx@lists.osr.com

4

> But is there any real way to determine which file/dir the IOCTL

is being called on without knowing the format of the IOCTL?

No. You have to know the structure of data coming with the IOCTL.
These IOCTLs are not sent to the file (the file object in the IRP
does not contain a file being made offline), but to the volume
device object. At least this is valid for IOCTL_CSC_COPY_CHUNK,
which is sent to the volume device object and the info structure contains
a HANDLE for the file being processed.

If you really insist on disabling offline files for particular file(s)
or dir(s), you till have to investigate the requests and find all necessary.

L.

5

Makes sense. Did you figure out the format of IOCTL_CSC_COPY_CHUNK by trial
and error? How could I go about finding out the structures that contain
handles?

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ladislav Zezula
Sent: Sunday, August 06, 2006 6:58 PM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] Offline files/CSC disablement?

But is there any real way to determine which file/dir the IOCTL is
being called on without knowing the format of the IOCTL?

No. You have to know the structure of data coming with the IOCTL.
These IOCTLs are not sent to the file (the file object in the IRP does not
contain a file being made offline), but to the volume device object. At
least this is valid for IOCTL_CSC_COPY_CHUNK, which is sent to the volume
device object and the info structure contains a HANDLE for the file being
processed.

If you really insist on disabling offline files for particular file(s) or
dir(s), you till have to investigate the requests and find all necessary.

L.

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@bitarmor.com To unsubscribe
send a blank email to xxxxx@lists.osr.com

6

> Makes sense. Did you figure out the format of IOCTL_CSC_COPY_CHUNK by

trial
and error? How could I go about finding out the structures that contain
handles?

Not by trial and error, but by debugging mrxsmb.sys calls. But I don’t have
it
anymore and I don’t know if this is the only call necessary to handle
in your case. You will have to reverse engineer mrxsmb.sys calls to get
the structure.

L.

7

Mathew,

I can get you a better answer with more detailed information about your
requirements. Some of the information that would help includes: Why do you
need to disable caching of certain files? How do you do decide which files
should not be cached? Which client OS versions you are targetting? Do you
control the server or just the client?

I would try to stay away from interfering with the CSC IOCTLs. Not only are
they undocumented, but they can change. For example, in Vista, those IOCTLs
no longer exist.

Note that, if you have control over the server share, you can set up the
share to disable caching by CSC.

  • Danilo
8

Danilo,

I control just the client, for 2K,XP,2K3, Vista. I decide which files
should not be cached by knowing about them in a file system filter driver.
There are two reasons I’d rather them not be cached. First, the CSC is not
playing well with “my” files and directories, presumably because I control a
completely different file object/VM state than the redirector. I’m
theorizing that handles opened to my files/dirs are getting passed in the
IOCTLs, which then don’t make sense to the redirector, causing problems.
Secondly, for certain reasons, I’d rather not have the data floating around
in that cache persistently for my special files.

How do you disable it on a per-share basis? The only thing I’ve seen is the
per-machine disable in the Explorer->Tools->Folder Options->Offline Files
tab.

Thanks,
Matt

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Danilo Almeida
Sent: Sunday, August 06, 2006 3:57 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Offline files/CSC disablement?

Mathew,

I can get you a better answer with more detailed information about your
requirements. Some of the information that would help includes: Why do you
need to disable caching of certain files? How do you do decide which files
should not be cached? Which client OS versions you are targetting? Do you
control the server or just the client?

I would try to stay away from interfering with the CSC IOCTLs. Not only are
they undocumented, but they can change. For example, in Vista, those IOCTLs
no longer exist.

Note that, if you have control over the server share, you can set up the
share to disable caching by CSC.

  • Danilo

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@bitarmor.com To unsubscribe
send a blank email to xxxxx@lists.osr.com

9

Disabling caching on a per-share basis is done at the server. There is a
share property that controls the caching for the share (in the sharing UI).

I’ll try to see whether I can find a solution for you.

  • Danilo

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Matthew N. White
Sent: Monday, August 07, 2006 12:15 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Offline files/CSC disablement?

Danilo,

I control just the client, for 2K,XP,2K3, Vista. I decide which files
should not be cached by knowing about them in a file system filter driver.
There are two reasons I’d rather them not be cached. First, the CSC is not
playing well with “my” files and directories, presumably because I control a
completely different file object/VM state than the redirector. I’m
theorizing that handles opened to my files/dirs are getting passed in the
IOCTLs, which then don’t make sense to the redirector, causing problems.
Secondly, for certain reasons, I’d rather not have the data floating around
in that cache persistently for my special files.

How do you disable it on a per-share basis? The only thing I’ve seen is the
per-machine disable in the Explorer->Tools->Folder Options->Offline Files
tab.

Thanks,
Matt

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Danilo Almeida
Sent: Sunday, August 06, 2006 3:57 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Offline files/CSC disablement?

Mathew,

I can get you a better answer with more detailed information about your
requirements. Some of the information that would help includes: Why do you
need to disable caching of certain files? How do you do decide which files
should not be cached? Which client OS versions you are targetting? Do you
control the server or just the client?

I would try to stay away from interfering with the CSC IOCTLs. Not only are
they undocumented, but they can change. For example, in Vista, those IOCTLs
no longer exist.

Note that, if you have control over the server share, you can set up the
share to disable caching by CSC.

  • Danilo

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@bitarmor.com To unsubscribe
send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@mit.edu To unsubscribe
send a blank email to xxxxx@lists.osr.com

10

There is a client-side setting that controls caching based on file
extension. Would that work in your case?

  • Danilo
11

Danilo,

Not really, the file name could be anything. I know about which files are
“my” files in my filter, though.

Thanks,
Matt

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Danilo Almeida
Sent: Wednesday, August 09, 2006 10:16 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Offline files/CSC disablement?

There is a client-side setting that controls caching based on file
extension. Would that work in your case?

  • Danilo

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@bitarmor.com To unsubscribe
send a blank email to xxxxx@lists.osr.com