Hi!
I’m quite new to filesystem filters. I’m writing a basic minifilter based
on the scanner windows sample. Is there a way to get a unique
identification of a mass storage device (hard drive, usb) from
‘InstanceSetup’ (or otherwise)? Unless I’m mistaken all of the following
functions provide an identification created by the filesystem, and are not
unique to a particular piece of hardware:
thx for the prompt reply! could you elaborate a bit further or point me to
the right direction please? I am quite new to the subject, and I have no
clue where to start…
Volume names are generated by the volume manager, not the file system.
If you need hardware specific information then you can query information
as Petr suggested. The volume GUID name is unique for a given storage
device and will not change, even across reboots.
Pete
On 1/8/2014 3:23 AM, George Gauci wrote:
Hi!
I’m quite new to filesystem filters. I’m writing a basic minifilter
based on the scanner windows sample. Is there a way to get a unique
identification of a mass storage device (hard drive, usb) from
‘InstanceSetup’ (or otherwise)? Unless I’m mistaken all of the
following functions provide an identification created by the
filesystem, and are not unique to a particular piece of hardware:
Thank you peter! Regarding the GUID, will it also be identical across
different machines?
Besides, can you please point me towards some documentation / tutorials /
samples / any source of information really, regarding how to query for the "
IOCTL_STORAGE_QUERY_PROPERTY "? I’m currently looking into how to make such
a query, but I’m still totally lost.
On 8 January 2014 16:38, Peter Scott wrote:
> > Volume names are generated by the volume manager, not the file system. If > you need hardware specific information then you can query information as > Petr suggested. The volume GUID name is unique for a given storage device > and will not change, even across reboots. > > Pete > > > On 1/8/2014 3:23 AM, George Gauci wrote: > > Hi! > I’m quite new to filesystem filters. I’m writing a basic minifilter based > on the scanner windows sample. Is there a way to get a unique > identification of a mass storage device (hard drive, usb) from > ‘InstanceSetup’ (or otherwise)? Unless I’m mistaken all of the following > functions provide an identification created by the filesystem, and are not > unique to a particular piece of hardware: > > - FltGetVolumeName > - FltGetVolumeProperties (RealDeviceName, FileSystemDeviceName) > - FltGetVolumeGuidName > - RtlVolumeDeviceToDosName > - IoVolumeDeviceToDosName > — NTFSD is sponsored by OSR OSR is hiring!! Info at > http://www.osr.com/careers For our schedule of debugging and file system > seminars visit: http://www.osr.com/seminars To unsubscribe, visit the > List Server section of OSR Online at > http://www.osronline.com/page.cfm?name=ListServer > > > – > Kernel Drivers > Windows File System and Device Driver Consultingwww.KernelDrivers.com866.263.9295 > > > — > NTFSD is sponsored by OSR > > OSR is hiring!! Info at http://www.osr.com/careers > > For our schedule of debugging and file system seminars visit: > http://www.osr.com/seminars > > To unsubscribe, visit the List Server section of OSR Online at > http://www.osronline.com/page.cfm?name=ListServer >
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of George Gauci
Sent: Wednesday, January 8, 2014 8:47 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] Physical device unique name
Thank you peter! Regarding the GUID, will it also be identical across different machines?
Besides, can you please point me towards some documentation / tutorials / samples / any source of information really, regarding how to query for the "IOCTL_STORAGE_QUERY_PROPERTY "? I’m currently looking into how to make such a query, but I’m still totally lost.
On 8 January 2014 16:38, Peter Scott > wrote:
Volume names are generated by the volume manager, not the file system. If you need hardware specific information then you can query information as Petr suggested. The volume GUID name is unique for a given storage device and will not change, even across reboots.
Pete
On 1/8/2014 3:23 AM, George Gauci wrote: Hi! I’m quite new to filesystem filters. I’m writing a basic minifilter based on the scanner windows sample. Is there a way to get a unique identification of a mass storage device (hard drive, usb) from ‘InstanceSetup’ (or otherwise)? Unless I’m mistaken all of the following functions provide an identification created by the filesystem, and are not unique to a particular piece of hardware:
- FltGetVolumeName - FltGetVolumeProperties (RealDeviceName, FileSystemDeviceName) - FltGetVolumeGuidName - RtlVolumeDeviceToDosName - IoVolumeDeviceToDosName — NTFSD is sponsored by OSR OSR is hiring!! Info at http://www.osr.com/careers For our schedule of debugging and file system seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
No, they are not the same across different machines. For this you’ll
need to pull something from the hardware itself.
Pete
On 1/8/2014 9:47 AM, George Gauci wrote:
Thank you peter! Regarding the GUID, will it also be identical across
different machines?
Besides, can you please point me towards some documentation /
tutorials / samples / any source of information really, regarding how
to query for the “IOCTL_STORAGE_QUERY_PROPERTY”? I’m currently looking
into how to make such a query, but I’m still totally lost.
On 8 January 2014 16:38, Peter Scott > mailto:xxxxx> wrote: > > > Volume names are generated by the volume manager, not the file > system. If you need hardware specific information then you can > query information as Petr suggested. The volume GUID name is > unique for a given storage device and will not change, even across > reboots. > > Pete > > > On 1/8/2014 3:23 AM, George Gauci wrote: >> Hi! >> I’m quite new to filesystem filters. I’m writing a basic >> minifilter based on the scanner windows sample. Is there a way to >> get a unique identification of a mass storage device (hard drive, >> usb) from ‘InstanceSetup’ (or otherwise)? Unless I’m mistaken all >> of the following functions provide an identification created by >> the filesystem, and are not unique to a particular piece of hardware: >> >> - FltGetVolumeName >> - FltGetVolumeProperties (RealDeviceName, FileSystemDeviceName) >> - FltGetVolumeGuidName >> - RtlVolumeDeviceToDosName >> - IoVolumeDeviceToDosName >> — NTFSD is sponsored by OSR OSR is hiring!! Info at >> http://www.osr.com/careers For our schedule of debugging and file >> system seminars visit: http://www.osr.com/seminars To >> unsubscribe, visit the List Server section of OSR Online at >> http://www.osronline.com/page.cfm?name=ListServer > > – > Kernel Drivers > Windows File System and Device Driver Consulting > www.KernelDrivers.comhttp: > 866.263.9295 tel:866.263.9295 > > > — > NTFSD is sponsored by OSR > > OSR is hiring!! Info at http://www.osr.com/careers > > For our schedule of debugging and file system seminars visit: > http://www.osr.com/seminars > > To unsubscribe, visit the List Server section of OSR Online at > http://www.osronline.com/page.cfm?name=ListServer > > > — NTFSD is sponsored by OSR OSR is hiring!! Info at > http://www.osr.com/careers For our schedule of debugging and file > system seminars visit: http://www.osr.com/seminars To unsubscribe, > visit the List Server section of OSR Online at > http://www.osronline.com/page.cfm?name=ListServer
– Kernel Drivers Windows File System and Device Driver Consulting www.KernelDrivers.com 866.263.9295</tel:866.263.9295></http:></mailto:xxxxx>
I had already encountered DeviceIoControl function, but this doesn’t seem
to work in kernel mode (please correct me if I’m missing something). The
idea is to get an identification of a mass storage device (harddrive or
usb) and decide whether to ‘filter’ the reads and writes to that volume,
based on a device whitelist (probably to be saved in the registry). The
minifilter must also be easily deployable on different machines, and so
there must be an easy way to refer to the whitelisted devices (the
information must be specific to the hardware, rather than software
generated).
On 8 January 2014 18:31, Peter Scott wrote:
> > No, they are not the same across different machines. For this you’ll need > to pull something from the hardware itself. > > Pete > > > On 1/8/2014 9:47 AM, George Gauci wrote: > > Thank you peter! Regarding the GUID, will it also be identical across > different machines? > Besides, can you please point me towards some documentation / tutorials / > samples / any source of information really, regarding how to query for the " > IOCTL_STORAGE_QUERY_PROPERTY "? I’m currently looking into how to make > such a query, but I’m still totally lost. > > > On 8 January 2014 16:38, Peter Scott wrote: > >> >> Volume names are generated by the volume manager, not the file system. If >> you need hardware specific information then you can query information as >> Petr suggested. The volume GUID name is unique for a given storage device >> and will not change, even across reboots. >> >> Pete >> >> >> On 1/8/2014 3:23 AM, George Gauci wrote: >> >> Hi! >> I’m quite new to filesystem filters. I’m writing a basic minifilter based >> on the scanner windows sample. Is there a way to get a unique >> identification of a mass storage device (hard drive, usb) from >> ‘InstanceSetup’ (or otherwise)? Unless I’m mistaken all of the following >> functions provide an identification created by the filesystem, and are not >> unique to a particular piece of hardware: >> >> - FltGetVolumeName >> - FltGetVolumeProperties (RealDeviceName, FileSystemDeviceName) >> - FltGetVolumeGuidName >> - RtlVolumeDeviceToDosName >> - IoVolumeDeviceToDosName >> — NTFSD is sponsored by OSR OSR is hiring!! Info at >> http://www.osr.com/careers For our schedule of debugging and file system >> seminars visit: http://www.osr.com/seminars To unsubscribe, visit the >> List Server section of OSR Online at >> http://www.osronline.com/page.cfm?name=ListServer >> >> >> – >> Kernel Drivers >> Windows File System and Device Driver Consultingwww.KernelDrivers.com866.263.9295 >> >> >> — >> NTFSD is sponsored by OSR >> >> OSR is hiring!! Info at http://www.osr.com/careers >> >> For our schedule of debugging and file system seminars visit: >> http://www.osr.com/seminars >> >> To unsubscribe, visit the List Server section of OSR Online at >> http://www.osronline.com/page.cfm?name=ListServer >> > > — NTFSD is sponsored by OSR OSR is hiring!! Info at > http://www.osr.com/careers For our schedule of debugging and file system > seminars visit: http://www.osr.com/seminars To unsubscribe, visit the > List Server section of OSR Online at > http://www.osronline.com/page.cfm?name=ListServer > > > – > Kernel Drivers > Windows File System and Device Driver Consultingwww.KernelDrivers.com866.263.9295 > > > — > NTFSD is sponsored by OSR > > OSR is hiring!! Info at http://www.osr.com/careers > > For our schedule of debugging and file system seminars visit: > http://www.osr.com/seminars > > To unsubscribe, visit the List Server section of OSR Online at > http://www.osronline.com/page.cfm?name=ListServer >