RE: Cannot observe IRP_MJ_READ for notepad?

NTFSD
1

Well if explorer reads from the file, then you open the file again,
perhaps the data was already in the cache, therefore
no paging read would need to occur.

Try opening the file through notepad from the command line, this way
explorer won’t be involved.

-Jeff

2

Thanks, Jeff.

I tried your suggestion. Yes, the message was observed.

For the PAGING_IO read, the filemon can display the file name, but minispy can not find the name. I am curious about that.
filemon shows:
E:\TEMP\XXXXXXXXXXXXXXXXXXX.TXT
minispy shows:


It needs to look into the implentation of filemon and minispy for the reason. I am just wondering some one already knew the reason?

3

Just looked a little bit to the minifilter, the minifilter use FltGetFileNameInformation with FLT_FILE_NAME_QUERY_DEFAULT to get the normalized name in pre-operation first. if the name is not available, then it try with FLT_FILE_NAME_QUERY_ALWAYS_ALLOW_CACHE_LOOKUP to get opened file name.

During paging IO, it is not safe to get the name and the name is not in cache too, so we can not get the name. I guess filemon save the name in creation operation, then it can display the name later.