There seems to be some confusion on this issue so let me explain how
this works:
A filters callback routine registered with
IoRegisterFsRegistrationChange is called whenever a file system calls
IoRegsterFileSystem.
In NT4 and Win2K you only received callbacks for any file systems that
called IoRegisterFileSystem after a filter called
IoRegisterFsRegistrationChange. As was mentioned earlier if your filter
needs to attach to any of the bootable file systems (ntfs or fat) then
your filter must load at boot time.
This functionality was changed in XP. In XP immediately upon calling
IoRegisterFsRegistrationChange the IO manager will call the filters
callback routine for all file systems that are already registered except
for the NULL file system.
When a filters registered callback routine is called they are given the
address of a file systems control device object. If they care about
filtering mounted volumes of this file system they should attach their
own device object to this given file systems device object. You are
doing this so that you can see volume mount requests for the file system
because they always go through the given file systems control device
object. It doesn’t matter whether this is removable media or not, all
mounts for local file systems occur this way.
As was stated earlier, the SFILTER and FILESPY samples in the XP version
of the IFSKit are very clear on how this all works and what exactly you
should do.
Do not worry about the fact that your FastIoDetach routine is not called
immediately after a volume is dismounted. There are lots of reasons
that the file systems keep around the old device objects for a period of
time. The system is doing the correct thing in these situations, don’t
worry about it.
All of the new RDR2 based redirectors now properly call
IoRegisterFileSystems. This means your IoRegisterFsRegistrationChange
callback will be called when one of these redirector file systems load.
For Win2K this was LanmanRedirector. For XP this includes
LanmanRedirector, WebDav, NFS, and RDPDR (terminal server redirector).
I am not currently aware of any plans by 3rd party redirectors (like
Netware) to switch over to the RDR2 model. For those guys you are going
to have to do some sort of polling to figure out when they load.
Neal Christiansen
This posting is provided “AS IS” with no warranties, and confers no
rights.
-----Original Message-----
From: Nicholas Ryan [mailto:xxxxx@secretseal.com]
Sent: Saturday, January 12, 2002 01:45 PM
To: File Systems Developers
Subject: [ntfsd] Re: Optimal way to attach to removable devices
Filespy in the XP IFS kit (NOT in the Win2k IFS kit) has extensive logic
demonstrating how to use IoRegisterFsRegistrationChange and hook
IRP_MN_MOUNT_VOLUME.
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Dejan Maksimovic
Sent: Saturday, January 12, 2002 10:36 AM
To: File Systems Developers
Subject: [ntfsd] Re: Optimal way to attach to removable devices
- Is IoRegisterFsRegistrationChange not used for notifying file
system
loading rather than media changes ?
Yes, but you get IRP_MJ_FILE_SYSTEM_CONTROL and by responding to
IRP_MN_MOUNT_VOLUME request, you can attach to any media - HD, CD,
floppy,
ZIP…
- Does IoRegisterFsRegistrationChange work for CD’s as well as
floppy’s as
well as mounted network drives ?
Yes, except that you don’t get any knowledge about network drives.
These are passed to you because you attach to LanmanRedirector.
All network drives are handled by LR, so don’t attach to them, or
you will
get all IRPs sent to any of them multiple times.
Path handling is a little uneasy here.
- Is IoRegisterFsRegistrationChange supported on Windows NT4?
Yes, except that you must attach to LanmanRedirector on NT, as it
doesn’t
get through the the above path.
–
Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32 developers.
Alfa File Protector - File protection and hiding library for Win32
developers.
Alfa Registry Monitor - Registry monitoring library for Win32
developers.
Alfa Registry Protector - Registry protection library for Win32
developers.
You are currently subscribed to ntfsd as: xxxxx@secretseal.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
You are currently subscribed to ntfsd as: xxxxx@Windows.Microsoft.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com