SL_RESTART_SCAN question

NTFSD
1

Hello all,

I would like to initialize a context structure for the first query calling (i.e. FindFirstFile). At Windows XP SP2 platform, this API function calls NtOpenFile to get a directory handle and then it calls NtQueryDirectoryFile with:

RestartScan = FALSE and ReturnSingleEntry = TRUE

DDK says, RestartScan should be TRUE for the first calling which is not true. FindNextFile calls NtQueryDirectoryFile with RestartScan = FALSE and ReturnSingleEntry = FALSE.

I’ve already made a workaround, but still I would like to know how you check the first query request in your drivers.

Thanks,
Petr

2

The docs are definitely wrong. You only need restart scan AFTER the
first call.

In the FSD work I’ve done I always know if this is the first call, since
first call is when I capture the search string. After first call, I
never recapture the search string (they have to close and reopen to
change the search string.) Thus, I’m not sure why this would be
difficult to detect.

Oh, remember the search string is associated with the specific file
object, not with the directory itself. This allows multiple callers to
enumerate the directory independently of one another.

Tony

Tony Mason

Consulting Partner

OSR Open Systems Resources, Inc.

http://www.osr.com http:</http:>

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Petr Kurtin
Sent: Tuesday, November 14, 2006 1:42 PM
To: ntfsd redirect
Subject: [ntfsd] SL_RESTART_SCAN question

Hello all,

I would like to initialize a context structure for the first query
calling (i.e. FindFirstFile). At Windows XP SP2 platform, this API
function calls NtOpenFile to get a directory handle and then it calls
NtQueryDirectoryFile with:

RestartScan = FALSE and ReturnSingleEntry = TRUE

DDK says, RestartScan should be TRUE for the first calling which is
not true. FindNextFile calls NtQueryDirectoryFile with RestartScan =
FALSE and ReturnSingleEntry = FALSE.

I’ve already made a workaround, but still I would like to know how
you check the first query request in your drivers.

Thanks,

Petr

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Petr,

IIRC, you can ignore RestartScan altogether. The first request ends on an
open handle starts being the first. There is no way to reset the scan if you
want to start scanning from the stop again. I might be remembering this
incorrectly as it has been a while, so someone should confirm/correct what
I’m saying.

HTH.

  • Danilo

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Petr Kurtin
Sent: Tuesday, November 14, 2006 1:42 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] SL_RESTART_SCAN question

Hello all,

I would like to initialize a context structure for the first query
calling (i.e. FindFirstFile). At Windows XP SP2 platform, this API function
calls NtOpenFile to get a directory handle and then it calls
NtQueryDirectoryFile with:

RestartScan = FALSE and ReturnSingleEntry = TRUE

DDK says, RestartScan should be TRUE for the first calling which is not
true. FindNextFile calls NtQueryDirectoryFile with RestartScan = FALSE and
ReturnSingleEntry = FALSE.

I’ve already made a workaround, but still I would like to know how you
check the first query request in your drivers.

Thanks,
Petr

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com