Question about paging io

NTFSD
1

Hi,

I have a mini filter which intercept the nocache write and paging io write.

In Windows 2003 i use wordpad to open a file and modify it and save. I only
see the cache write, i didn’t see any nocache write and paging io write. I ran the file
spy, it shows the same result.

In windows 2008 i did the same test, i will see the cache write then follow with paging io
write.

Why i can’t see the paging io write in windows 2003?

Thanks
Tsang

2

I found that if i modify the small files ( for example less than 2k), i can’t see the paging io from system thread. If i modify the bigger files, i will see the cache write and paging io write.

Does anybody know the reason?

Thanks
Tsang

3

The IO is probably to the MFT. It used to be that you saw the paging writes
as being to the MFT, but I thought that this was changed sometime back in
win2k. However I’ve never had to care about it so I’m not certain of my
facts…

R

wrote in message news:xxxxx@ntfsd…

I found that if i modify the small files ( for example less than 2k), i
can’t see the paging io from system thread. If i modify the bigger files, i
will see the cache write and paging io write.

Does anybody know the reason?

Thanks
Tsang