Has anyone seen this – is there a problem in fltmgr?
On rare occasions I get filename information returned with a directory path
seqment in lower case that I know isn’t (“c:\program files” for instance). I
always call with flags = (FLT_FILE_NAME_NORMALIZED |
FLT_FILE_NAME_QUERY_DEFAULT). Calls are usually made from either my
post-CREATE or post-SET_INFORMATION(FileRenameInformation) handler. Under
certain unusual circumstances, I will make this call in my pre-CLOSE
handler.
Unfortunately, I have only seen this at a couple of customer sites and have
no real data other than the systems were most likely running WS03 SP1.
Is it possible the filter manger name cache has the information cached from
some other call using FLT_FILE_NAME_OPENED? I’m also trying to find out if
operation had a ReleatedFileObject or not.
/ted
Calling the file system to get the name in the pre-close situation may not
work. In a filter I once worked on, NTFS had already released the name in
post-cleanup and when calling for the file name in the pre-close, I was
occasionally getting garbage; sometimes it was the right name because the
memory had not been reallocated to someone else.
Not sure if this is your problem, but it may be worth investigating.
Pre-close is very limiting in that you can not do very much.
Jamey
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ted Hess
Sent: Wednesday, August 31, 2005 11:07 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Strange result from FltGetFileNameInformation
Has anyone seen this – is there a problem in fltmgr?
On rare occasions I get filename information returned with a directory path
seqment in lower case that I know isn’t (“c:\program files” for instance). I
always call with flags = (FLT_FILE_NAME_NORMALIZED |
FLT_FILE_NAME_QUERY_DEFAULT). Calls are usually made from either my
post-CREATE or post-SET_INFORMATION(FileRenameInformation) handler. Under
certain unusual circumstances, I will make this call in my pre-CLOSE
handler.
Unfortunately, I have only seen this at a couple of customer sites and have
no real data other than the systems were most likely running WS03 SP1.
Is it possible the filter manger name cache has the information cached from
some other call using FLT_FILE_NAME_OPENED? I’m also trying to find out if
operation had a ReleatedFileObject or not.
/ted
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@rocketdivision.com
To unsubscribe send a blank email to xxxxx@lists.osr.com