Some question about filter drivers

NTFSD
1

Hello,

I need to know some things…

1- How can I know that some process rename a file…? I’m read my all
information and I can’t find what IRP and what option check…

2- How can I know that some process delete a file…? I’m read my all
information and I can’t find what IRP and what option check…

3- If my filter dirver don’t implement FasIO routines, mat cause a
crach…?

thanks and regards

Moises

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

2

Moises Herrera Vazquez wrote:

1- How can I know that some process rename a file…? I’m read my all
information and I can’t find what IRP and what option check…

It’s IRP_MJ_SET_INFORMATION with FileRenameInformation in
IrpSp->Parameters.SetFile.FileInformationClass

2- How can I know that some process delete a file…? I’m read my all
information and I can’t find what IRP and what option check…

IRP_MJ_SET_INFORMATION/FileDispositionInformation

3- If my filter dirver don’t implement FasIO routines, mat cause a
crach…?

If there is an NTFS drive, it will, no doubt.

–
Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
E-mail: xxxxx@alfasp.com
ICQ#: 56570367
Alfa File Monitor - File monitoring system for Win32 developers.
Alfa File Protector - File protection and hiding system for Win32
developers.

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

3

MessageYou can return FALSE or STATUS_NOT_IMPLEMENTED from all your FastIo functions. After FALSE is returned system will build a standard IRP. This can probably hit the performance but I think it’s OK if you want to focus on implementing you driver features first and optimizing it for better performance later.
----- Original Message -----
From: Moises Herrera Vazquez
To: File Systems Developers
Sent: Saturday, September 29, 2001 19:48
Subject: [ntfsd] Some question about filter drivers

Hello,

I need to know some things…

1- How can I know that some process rename a file…? I’m read my all information and I can’t find what IRP and what option check…

2- How can I know that some process delete a file…? I’m read my all information and I can’t find what IRP and what option check…

3- If my filter dirver don’t implement FasIO routines, mat cause a crach…?

thanks and regards

Moises

You are currently subscribed to ntfsd as: xxxxx@vba.com.by
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

4

Message1. IRP_MJ_SET_INFORMATION/FileNameInformation
2. IRP_MJ_SET_INFORMATION/FileDispositionInformation
3. Better to implement them as SFILTER does.

Max

----- Original Message -----
From: Moises Herrera Vazquez
To: File Systems Developers
Sent: Saturday, September 29, 2001 8:48 PM
Subject: [ntfsd] Some question about filter drivers

Hello,

I need to know some things…

1- How can I know that some process rename a file…? I’m read my all information and I can’t find what IRP and what option check…

2- How can I know that some process delete a file…? I’m read my all information and I can’t find what IRP and what option check…

3- If my filter dirver don’t implement FasIO routines, mat cause a crach…?

thanks and regards

Moises

You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

5

MessageI agree with Max, but you should know that there is another
way to delete a file: create it with FILE_DELETE_ON_CLOSE
and then close it. In any way the physical deletion is done
when the last handle is closed - thus in IRP_MJ_CLEANUP.
And the create flag or set file info are only two different ways
to tell the FSD that the file should be deleted after it has been
closed.

So if you want to prevent deletion of some file you have to check
both ways and return some error without calling the next driver
in the stack.

Hope this helps,
Paul

PS: Max, I think you thought FileRenameInformation instead of
FileNameInformation, but your fingers have betrayed you :-))
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Maxim S. Shatskih
Sent: Sunday, September 30, 2001 3:10 AM
To: File Systems Developers
Subject: [ntfsd] Re: Some question about filter drivers

  1. IRP_MJ_SET_INFORMATION/FileNameInformation
  2. IRP_MJ_SET_INFORMATION/FileDispositionInformation
  3. Better to implement them as SFILTER does.

Max

----- Original Message -----
From: Moises Herrera Vazquez
To: File Systems Developers
Sent: Saturday, September 29, 2001 8:48 PM
Subject: [ntfsd] Some question about filter drivers

Hello,

I need to know some things…

1- How can I know that some process rename a file…? I’m read my all
information and I can’t find what IRP and what option check…

2- How can I know that some process delete a file…? I’m read my all
information and I can’t find what IRP and what option check…

3- If my filter dirver don’t implement FasIO routines, mat cause a
crach…?

thanks and regards

Moises

You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntfsd as: xxxxx@compelson.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com