Redirecting data to be stored in one drive into another drive.

NTFSD
1

Hi All,
Can anyone tell me whether can we redirect data from one drive/volume to another.
What I exactly want is like this:
Say we are opening volume X and want to transfer the writes(all the write operations) to volume Y.
But the thing is that, say I have created a file in volume X & saved it. I want to save this file into volume Y, but I want to show it when I explore volume X.
In other words, I want to save everything in Volume Y but want to access them from volume X.
Is this possible. And if yes then do I need to go with File System Filter driver only or I have some other option also.
Thanks.

Regards,
Diptesh Patel.

2

You haven’t provided enough information to answer the question.

  1. Do you want the files(s) on X: to be updated too?
  2. Is this a backup or a rollback type of application?
  3. Is it important that all updates on Y: be preserved?

I. If a backup type of system, just use a storage driver of some sort to
provide mirroring. This will restrict you to having the second drive being
equal or larger than the first drive.
II. If a rollback, consider using VMware with its excellent snapshots. You
can do your own with a storage driver with the same restriction as in I,
above.
III. If a master drive with Y: being only changes it can be done at the
filesystem level, but the storage level is much easier and VMware even
easier.
IV. A master drive system with VMware will be easy since snapshots can be
taken from a common point:
a) Snapshot drive X:
b) All changes will be in straight line from that snapshot and you can
drop all changes by reverting to the snapshot.
c) If you want to save the changes, you can branch from the snapshot in
X: but are able to switch back to the changes in b), above at any time.
d) With VMware you can just copy the snapshot in a) above and copy it
into another folder and have another instance.
c) Much of your testing of any of these options can be done with VMware
for easy recovery or you can use Symantec Ghost (not Norton Ghost) to
recover from bugs.

wrote in message news:xxxxx@ntfsd…
> Hi All,
> Can anyone tell me whether can we redirect data from one drive/volume to
> another.
> What I exactly want is like this:
> Say we are opening volume X and want to transfer the writes(all the write
> operations) to volume Y.
> But the thing is that, say I have created a file in volume X & saved it. I
> want to save this file into volume Y, but I want to show it when I explore
> volume X.
> In other words, I want to save everything in Volume Y but want to access
> them from volume X.
> Is this possible. And if yes then do I need to go with File System Filter
> driver only or I have some other option also.
> Thanks.
>
> Regards,
> Diptesh Patel.
>

3

NTFS allows you to mount volume as an folder.

If you need some special requirments the reparse points are your point of concern. The FSFD/minifilter checks the path at volume X. If path goes into reparse point the filter fails IRP_MJ_CREATE with STATUS_REPARSE and allocates and fills target FILE_OBJECT.Filename. BY this way it can redirect request.

-bg

4

Hi David,
Thanks for showing your interest.
Let me make my question more clear :
Say I have a C drive with total 10 GB in which 2 GB space is free.
Now I am mounting this 2GB free space as another volume , say volume Y.
So now what I want to do is that after mounting this new volume,
whenever I will access C drive, I will be allowed to read all the data stored in C drive, but when I write something ( i.e save some new file, or edit existing file) that will be saved on volume Y.
And I don’t want to show volume Y to user.
So if in C drive a user creates a new file & saves it, it will be saved on volume Y, but will be accessed from C drive only, as volume Y is not visible to user.

By this what I want to do is that once I unmount the Y volume, my C drive will be as it was before mounting Y volume. No write operations were performed on C drive.

If you have got my idea, then please let me know whether is this possible. And if yes, can you suggest me some path?
Thanks.

Diptesh.

5

It will be a several man-month project and I think a file system or file
system filter will be required. You can’t block all writes since your
driver will load later than the OS, but I don’t think much will be written
that you care about. The biggest problems are with the registry since it
will be opened before you load.

I don’t get this C: drive with 10GB and 2GB free being mounted as another
volume. Free space belongs to the volume named C: and how do you plan to
create a volume with it? I can’t think of any reliable way to do so.

wrote in message news:xxxxx@ntfsd…
> Hi David,
> Thanks for showing your interest.
> Let me make my question more clear :
> Say I have a C drive with total 10 GB in which 2 GB space is free.
> Now I am mounting this 2GB free space as another volume , say volume Y.
> So now what I want to do is that after mounting this new volume,
> whenever I will access C drive, I will be allowed to read all the data
> stored in C drive, but when I write something ( i.e save some new file, or
> edit existing file) that will be saved on volume Y.
> And I don’t want to show volume Y to user.
> So if in C drive a user creates a new file & saves it, it will be saved on
> volume Y, but will be accessed from C drive only, as volume Y is not
> visible to user.
>
> By this what I want to do is that once I unmount the Y volume, my C drive
> will be as it was before mounting Y volume. No write operations were
> performed on C drive.
>
> If you have got my idea, then please let me know whether is this possible.
> And if yes, can you suggest me some path?
> Thanks.
>
> Diptesh.
>

6

wrote in message news:xxxxx@ntfsd…
> So if in C drive a user creates a new file & saves it, it will be saved on
> volume Y, but will be accessed from C drive only, as volume Y is not
> visible to user.
> By this what I want to do is that once I unmount the Y volume, my C drive
> will be as it was before mounting Y volume. No write operations were
> performed on C drive.
>
> If you have got my idea, then please let me know whether is this possible.
> And if yes, can you suggest me some path?
> Thanks.
>

“but will be accessed from C drive only”. What precisely do you mean ? The
physical storage of volume Y is drive C. If you overwrite an existing file
on “volume” C, what is supposed to happen ? If you read a file which exists
on both volumes, then what ?

It’s better you tell what are the real requirements of your product. What is
the whole purpose of having “volume Y” ? This could be either some sort of
virtualization product or otherwise one of those applications for cybercafes
which restores a system to its original state after each session.

//Daniel

7

Hi David,
Yes, you are right, if registry will be opened when the OS loads, then it will be a problem for me.
But other then registry, for normal read/write of files/directories will this be possible?

And about your question that the free space of C: drive, I am able to mount this space as another volume by creating a file with this much space(equal to free space of C: drive) & then mount this file as another volume. For this I have got help from TrueCrypt.

Diptesh.

8

I doubt you are going to get this correct. It will be a real mess to
control. There are other files open, but I don’t know of any other than the
registry that will be written to in normal use. Don’t forget about
Windows/Microsoft Update that can replace many of the system files. Some of
those replacements occur early in the next boot sequence which may be before
you have been loaded. If you get this wrong you could have mismatched
operating system files where maybe hal.sys or ntkrnl.exe won’t match. Other
OS files might also be involved.

wrote in message news:xxxxx@ntfsd…
> Hi David,
> Yes, you are right, if registry will be opened when the OS loads, then it
> will be a problem for me.
> But other then registry, for normal read/write of files/directories will
> this be possible?
>
> And about your question that the free space of C: drive, I am able to
> mount this space as another volume by creating a file with this much
> space(equal to free space of C: drive) & then mount this file as another
> volume. For this I have got help from TrueCrypt.
>
> Diptesh.
>

9

Hi Daniel,
yes, exactly. This is a kind of applications for cybercafes which restores a system to its original state after each session.

The physical storage of volume Y is drive C: only, but it will be a file inside C: drive in which it will store all the contents of volume Y.
I think you won’t get this. Right!! See I have created a file equal to free space of C: drive (lets say a file named “resore.dat”) & have mounted it as a new volume, say volume Y. So whatever I will save in this volume Y, actually it will be saved in that “restore.dat” file.

All this will happen once I load my drive.
Now I want this volume Y to be hidden, so C: drive is only the one what the user has access to.
As per your question, “if you overwrite an existing file on volume C:”, it will save an entire copy of that modified file into volume Y:, and now when user access it from C: drive, he will get the copy from volume Y:, that I will have to maintain.
And another question, “If you read a file which exists on both volumes”, in such cases, it will always first try to search the required file in volume Y: and if it not available over there then only it will go to C: drive to read that file. And on other hand, on all write cases, it will always write into volume Y:, nothing on C: drive.
This will help me to restore the session, by just unmounting that Y: volume & deleting that “restore.dat”, so that my C: drive will be as it was before loading my driver.
Thanks.

Diptesh.

10

Before diving into a file system filter, consider the following options:

-create a solution which uses Windows System Restore
-create a solution based on the Volume Shadow Copy service (don’t know about
it but recently mentioned by Mark Roddy on this forum)

-write a disk (storage) filter so you only need to tracks what sectors have
changed. I think the challenge in this type of solution is to have a good
performing cache mechanism to makeit perform well but it’s going to be much
easier than doing this at FS level. Note that you will not be able to make
any decision based on any file observation, you just put the whole thing on
or off.

//Daniel

wrote in message news:xxxxx@ntfsd…
> Hi Daniel,
> yes, exactly. This is a kind of applications for cybercafes which restores
> a system to its original state after each session.
>
> The physical storage of volume Y is drive C: only, but it will be a file
> inside C: drive in which it will store all the contents of volume Y.
> I think you won’t get this. Right!! See I have created a file equal to
> free space of C: drive (lets say a file named “resore.dat”) & have
> mounted it as a new volume, say volume Y. So whatever I will save in this
> volume Y, actually it will be saved in that “restore.dat” file.
>
> All this will happen once I load my drive.
> Now I want this volume Y to be hidden, so C: drive is only the one what
> the user has access to.
> As per your question, “if you overwrite an existing file on volume C:”, it
> will save an entire copy of that modified file into volume Y:, and now
> when user access it from C: drive, he will get the copy from volume Y:,
> that I will have to maintain.
> And another question, “If you read a file which exists on both volumes”,
> in such cases, it will always first try to search the required file in
> volume Y: and if it not available over there then only it will go to C:
> drive to read that file. And on other hand, on all write cases, it will
> always write into volume Y:, nothing on C: drive.
> This will help me to restore the session, by just unmounting that Y:
> volume & deleting that “restore.dat”, so that my C: drive will be as it
> was before loading my driver.
> Thanks.
>
> Diptesh.
>

11

>>.yes, exactly. This is a kind of applications for cybercafes which
restores a system to its original state after each session.

Have you looked at Windows Steady State which is designed for this?

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@slscorp.com
Sent: 08 July 2008 06:11
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] Redirecting data to be stored in one drive into
another drive.

*** WARNING ***

This mail has originated outside your organization, either from an
external partner or the Global Internet.
Keep this in mind if you answer this message.

Hi Daniel,
yes, exactly. This is a kind of applications for cybercafes which
restores a system to its original state after each session.

The physical storage of volume Y is drive C: only, but it will be a file
inside C: drive in which it will store all the contents of volume Y.
I think you won’t get this. Right!! See I have created a file equal to
free space of C: drive (lets say a file named “resore.dat”) & have
mounted it as a new volume, say volume Y. So whatever I will save in
this volume Y, actually it will be saved in that “restore.dat” file.

All this will happen once I load my drive.
Now I want this volume Y to be hidden, so C: drive is only the one what
the user has access to.
As per your question, “if you overwrite an existing file on volume C:”,
it will save an entire copy of that modified file into volume Y:, and
now when user access it from C: drive, he will get the copy from volume
Y:, that I will have to maintain.
And another question, “If you read a file which exists on both volumes”,
in such cases, it will always first try to search the required file in
volume Y: and if it not available over there then only it will go to C:
drive to read that file. And on other hand, on all write cases, it will
always write into volume Y:, nothing on C: drive.
This will help me to restore the session, by just unmounting that Y:
volume & deleting that “restore.dat”, so that my C: drive will be as it
was before loading my driver.
Thanks.

Diptesh.

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars (including our new
fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@baesystems.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

********************************************************************
This email and any attachments are confidential to the intended
recipient and may also be privileged. If you are not the intended
recipient please delete it from your system and notify the sender.
You should not copy it or use it for any purpose nor disclose or
distribute its contents to any other person.
********************************************************************

12

“Oliver, Jonathan (UK)” wrote in message
news:xxxxx@ntfsd…
>>.yes, exactly. This is a kind of applications for cybercafes which
restores a system to its original state after each session.

>Have you looked at Windows Steady State which is designed for this?

Note that this is a totally different type of solution, it is just yet
another layer of user restrictions and account control.

//Daniel