Is it possible to implement a read-only NTFS volume on Windows 2000? I have
tried dropping all write IOs (which is a bad idea as pointed out by some
listers here) and had a file filter that fails IRP_MJ_CREATE irps to prevent
changes to files. My attempt seemed to work fine until I tried to mount an
NTFS volume formated by NT4. Windows 2000 made some changes to the MFT and
other meta files to update the volume to 2k. These write operations did not
go through my write dispatch routine.
I run out off ideas what to try next. If I set the write protected flag,
the volume wont mount succesfully, if I dont set the write protected flag,
Windows will somehow write to the volume. Your help is greatly appreciated.
Chu Bun
Have a volume filter drop the writes instead of a filesystem filter?
ChuBun wrote:
Is it possible to implement a read-only NTFS volume on Windows 2000? I have
tried dropping all write IOs (which is a bad idea as pointed out by some
listers here) and had a file filter that fails IRP_MJ_CREATE irps to prevent
changes to files. My attempt seemed to work fine until I tried to mount an
NTFS volume formated by NT4. Windows 2000 made some changes to the MFT and
other meta files to update the volume to 2k. These write operations did not
go through my write dispatch routine.
I run out off ideas what to try next. If I set the write protected flag,
the volume wont mount succesfully, if I dont set the write protected flag,
Windows will somehow write to the volume. Your help is greatly appreciated.
Chu Bun
–
Nick Ryan (MVP for DDK)
CROSS POSTING VIOLATION!
We must punish such offenders!
Jamey Kirby, Windows DDK MVP
StorageCraft Inc.
xxxxx@storagecraft.com
http://www.storagecraft.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of ChuBun
Sent: Tuesday, September 16, 2003 1:25 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Read-Only NTFS on 2000?
Is it possible to implement a read-only NTFS volume on Windows 2000? I have
tried dropping all write IOs (which is a bad idea as pointed out by some
listers here) and had a file filter that fails IRP_MJ_CREATE irps to prevent
changes to files. My attempt seemed to work fine until I tried to mount an
NTFS volume formated by NT4. Windows 2000 made some changes to the MFT and
other meta files to update the volume to 2k. These write operations did not
go through my write dispatch routine.
I run out off ideas what to try next. If I set the write protected flag,
the volume wont mount succesfully, if I dont set the write protected flag,
Windows will somehow write to the volume. Your help is greatly appreciated.
Chu Bun
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: xxxxx@storagecraft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
Eventually this will crash. You can cache them an read them back, but
throwing them away will eventually make the disk corrupt; or at least the
cache to disk coherency is shot to crap.
Jamey Kirby, Windows DDK MVP
StorageCraft Inc.
xxxxx@storagecraft.com
http://www.storagecraft.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Nick Ryan
Sent: Tuesday, September 16, 2003 2:10 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Re: Read-Only NTFS on 2000?
Have a volume filter drop the writes instead of a filesystem filter?
ChuBun wrote:
Is it possible to implement a read-only NTFS volume on Windows 2000? I
have
tried dropping all write IOs (which is a bad idea as pointed out by some
listers here) and had a file filter that fails IRP_MJ_CREATE irps to
prevent
changes to files. My attempt seemed to work fine until I tried to mount
an
NTFS volume formated by NT4. Windows 2000 made some changes to the MFT
and
other meta files to update the volume to 2k. These write operations did
not
go through my write dispatch routine.
I run out off ideas what to try next. If I set the write protected flag,
the volume wont mount succesfully, if I dont set the write protected flag,
Windows will somehow write to the volume. Your help is greatly
appreciated.
Chu Bun
–
Nick Ryan (MVP for DDK)
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: xxxxx@storagecraft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
Huh?
“Jamey Kirby” wrote in message news:xxxxx@ntdev…
CROSS POSTING VIOLATION!
We must punish such offenders!
Jamey Kirby, Windows DDK MVP
StorageCraft Inc.
xxxxx@storagecraft.com
http://www.storagecraft.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of ChuBun
Sent: Tuesday, September 16, 2003 1:25 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Read-Only NTFS on 2000?
Is it possible to implement a read-only NTFS volume on Windows 2000? I have
tried dropping all write IOs (which is a bad idea as pointed out by some
listers here) and had a file filter that fails IRP_MJ_CREATE irps to prevent
changes to files. My attempt seemed to work fine until I tried to mount an
NTFS volume formated by NT4. Windows 2000 made some changes to the MFT and
other meta files to update the volume to 2k. These write operations did not
go through my write dispatch routine.
I run out off ideas what to try next. If I set the write protected flag,
the volume wont mount succesfully, if I dont set the write protected flag,
Windows will somehow write to the volume. Your help is greatly appreciated.
Chu Bun
—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: xxxxx@storagecraft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
“Nick Ryan” wrote in message news:xxxxx@ntdev…
>
> Have a volume filter drop the writes instead of a filesystem filter?
>
I think there is something special about the write operations generated when
the system converts a volume from NTFS 4.0 to NTFS 5.0. These writes do not
go through my write dispatch routine. I doubt that a filter driver will be
able to catch and drop them. Besides, conversion happens when the volume is
mounted and before the filter is loaded.
ChuBun wrote:
“Nick Ryan” wrote in message news:xxxxx@ntdev…
>
>>Have a volume filter drop the writes instead of a filesystem filter?
>>
>
>
> I think there is something special about the write operations generated when
> the system converts a volume from NTFS 4.0 to NTFS 5.0. These writes do not
> go through my write dispatch routine. I doubt that a filter driver will be
> able to catch and drop them. Besides, conversion happens when the volume is
> mounted and before the filter is loaded.
Any correctly-written filesystem should send its IRPs to the top of the
storage stack (the one given to it in the MountVolume parameters) and
not the bottom (the bottom is represented by the RealDevice field in the
VPB). Any correctly-written and installed upper-disk filter should
therefore be able to intercept all requests.
Anyways I recall endless discussion on this NTFS read-only issue a few
months ago, with some words by Peter Wieland (Microsoft). Perhaps you
can go search the archives.
–
Nick Ryan (MVP for DDK)