problem about volume mount/dismount

NTFSD
1

I need to monitor volume mount/dismout operation.
I use sfilter in DDK to monitor mount/dismount operation,during boot i can
get mount intercept IRP_MN_MOUNT_VOLUME operation,but after boot, I can’t
receive any notification about volume mount/dismount.
Such as I mount a PGP disk and dismount it, my driver can’t intercept the
both operations.
Who can help me?

BTW: sometime I can intercept it,but usually I can’t. :frowning:

2

Cool, someone mentioned PGPdisk (I wrote that like 4 years ago when I
was at PGP). There’s no reason why this shouldn’t work. I suggest
examining the mount processing code in the filespy sample in the IFSKIT,
it’s a tricky task.

Ares Lee wrote:

I need to monitor volume mount/dismout operation.
I use sfilter in DDK to monitor mount/dismount operation,during boot i can
get mount intercept IRP_MN_MOUNT_VOLUME operation,but after boot, I can’t
receive any notification about volume mount/dismount.
Such as I mount a PGP disk and dismount it, my driver can’t intercept the
both operations.
Who can help me?

BTW: sometime I can intercept it,but usually I can’t. :frowning:

–
Nick Ryan (MVP for DDK)

3

In fact, I can intercept IRP_MN_MOUNT_VOLUME when I mount a PGPDisk,but in
completion routine, I receive status 0xC000026E and 0xC000014F,after twice
call completion routine,the PGPDisk is mount,But I have not intercept the
completion call with status STATUS_SUCCESS,So I can’t attach my filter to
storage device.

Cool, someone mentioned PGPdisk (I wrote that like 4 years ago when I
was at PGP). There’s no reason why this shouldn’t work. I suggest
examining the mount processing code in the filespy sample in the IFSKIT,
it’s a tricky task.

Ares Lee wrote:

> I need to monitor volume mount/dismout operation.
> I use sfilter in DDK to monitor mount/dismount operation,during boot i can
> get mount intercept IRP_MN_MOUNT_VOLUME operation,but after boot, I can’t
> receive any notification about volume mount/dismount.
> Such as I mount a PGP disk and dismount it, my driver can’t intercept the
> both operations.
> Who can help me?
>
> BTW: sometime I can intercept it,but usually I can’t. :frowning:
>
>

–
Nick Ryan (MVP for DDK)

4

During test,I found I can intercept volume mount/dismount operation on
NTFS volume, But can’t do that on FAT volume.
I set a breakpoint on callback routine set by
IoRegisterFsRegistrationChange(),and I found I get notification when
“\NFTS” filesystem driver is loaded, but I HAVE NOT GET NOTIFICATION from
“\FASTFAT” driver.

Who can help me!
Thx

5

Check your load order. The Group value must be “filter”, the Start value must
be Boot (which is 0 IIRC).

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Ares Lee”
To: “Windows File Systems Devs Interest List”
Sent: Wednesday, September 17, 2003 1:59 PM
Subject: [ntfsd] Re: problem about volume mount/dismount

> During test,I found I can intercept volume mount/dismount operation on
> NTFS volume, But can’t do that on FAT volume.
> I set a breakpoint on callback routine set by
> IoRegisterFsRegistrationChange(),and I found I get notification when
> “\NFTS” filesystem driver is loaded, but I HAVE NOT GET NOTIFICATION from
> “\FASTFAT” driver.
>
> Who can help me!
> Thx
>
> —
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

6

That means your system partition is FAT. W2k does not call IoRegister* for
file systems that got loaded before it (ie it had to load FASTFAT no matter
what otherwise it couldn’t have brought up the system). I believe they
fixed this on windows XP and higher. IOW your recognizer isn’t called for
whatever the system partition is, but the driver is still loaded and volumes
mounted.

Thanks,
Rob

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-ntfsd-
xxxxx@lists.osr.com] On Behalf Of Ares Lee
Sent: Wednesday, September 17, 2003 5:59 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Re: problem about volume mount/dismount

During test,I found I can intercept volume mount/dismount operation on
NTFS volume, But can’t do that on FAT volume.
I set a breakpoint on callback routine set by
IoRegisterFsRegistrationChange(),and I found I get notification when
“\NFTS” filesystem driver is loaded, but I HAVE NOT GET NOTIFICATION from
“\FASTFAT” driver.

Who can help me!
Thx

You are currently subscribed to ntfsd as: xxxxx@cdp.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

7

Maxim ShatskihF
Thx for your answer.
But I have set startype value to 0(BOOT),and I can intercept other FSD
register.Only the “\FASTFAT” I can’t intercept. :frowning:

8

Rob:
Do you mean that if my boot driver was NTFS volume that I wouldn’t
intercept NTFS volume mount/dismount operations?
Can I attach my FS filter to FASTFAT FSD manually in DriverEntry
routine?

9

In XP and later, you can call IoRegisterFsRegistrationChange any time
and will be told about every registered FSD. Pre-XP you will only be
told about FSDs that register after you, so if you don’t want to start
at boot time you’ll have to manually attach to the common filesystems by
name.

Ares Lee wrote:

Rob:
Do you mean that if my boot driver was NTFS volume that I wouldn’t
intercept NTFS volume mount/dismount operations?
Can I attach my FS filter to FASTFAT FSD manually in DriverEntry
routine?

–
Nick Ryan (MVP for DDK)