timestamp and backup in file filter

NTFSD
1

Hi, All,

I have the following questions when I implement my first file filter, can
anybody help with that? more detail, more welcome.

  1. How can I retrieve the timestamp(last access time, modification time,
    creation time) of the targeted file in my file filter?

  2. Whenever I modify and write a file, I try to intercept the IRP and store
    the file in different name, so as to keep track of the modification. How can
    I do that?

Thanks a lot.

Bill Den

2

> 1. How can I retrieve the timestamp(last access time, modification time,

creation time) of the targeted file in my file filter?

ZwQueryInformationFile() / IRP_MJ_QUERY_INFORMATION

  1. Whenever I modify and write a file, I try to intercept the IRP and
    store
    the file in different name, so as to keep track of the modification. How
    can
    I do that?

ZwCreateFile() / IRP_MJ_CREATE
ZwReadFile() / IRP_MJ_READ
ZwWriteFile() / IRP_MJ_WRITE

The Zw will be sent to the FS stack, so you’d have to handle the reentrance
to not back-up your back-up your back-up your back-up.

3

I did a filter like this many years ago for DOS and Windows 3.1. What I did
was to trap the create call, compare the date and time stamp of the current
backup to the existing file. If the file is newer than the backup, copy the
file and then let the create path continue.

Jamey Kirby, Windows DDK MVP
StorageCraft Inc.
xxxxx@storagecraft.com
http://www.storagecraft.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Tobias
Sent: Tuesday, August 19, 2003 11:29 PM
To: File Systems Developers
Subject: [ntfsd] Re: timestamp and backup in file filter

  1. How can I retrieve the timestamp(last access time, modification time,
    creation time) of the targeted file in my file filter?

ZwQueryInformationFile() / IRP_MJ_QUERY_INFORMATION

  1. Whenever I modify and write a file, I try to intercept the IRP and
    store
    the file in different name, so as to keep track of the modification. How
    can
    I do that?

ZwCreateFile() / IRP_MJ_CREATE
ZwReadFile() / IRP_MJ_READ
ZwWriteFile() / IRP_MJ_WRITE

The Zw will be sent to the FS stack, so you’d have to handle the reentrance
to not back-up your back-up your back-up your back-up.

You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

Thank you, Tobias, but what did your last sentence mean? I am a little
lost.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Tobias
Sent: Tuesday, August 19, 2003 11:29 PM
To: File Systems Developers
Subject: [ntfsd] Re: timestamp and backup in file filter

> 1. How can I retrieve the timestamp(last access time, modification time,
> creation time) of the targeted file in my file filter?

ZwQueryInformationFile() / IRP_MJ_QUERY_INFORMATION

> 2. Whenever I modify and write a file, I try to intercept the IRP and
store
> the file in different name, so as to keep track of the modification. How
can
> I do that?

ZwCreateFile() / IRP_MJ_CREATE
ZwReadFile() / IRP_MJ_READ
ZwWriteFile() / IRP_MJ_WRITE

The Zw will be sent to the FS stack, so you’d have to handle the
reentrance
to not back-up your back-up your back-up your back-up.

You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

I am somewhat “against” doing product design on this forum.

However, his last sentence means exactly what is said.

Zw calls to through the i/o subsystem, so if you have a filter on the
volume, you will see your own Zw open of the file you are filtering
through your own file system filter. This can cause infinite recursion
if you don’t handle it correctly. You will need to understand how the
IPR stack and i/o subsystem to develop your product.

/TomH

-----Original Message-----
From: Bill Deng [mailto:xxxxx@hotmail.com]
Sent: Wednesday, August 20, 2003 10:38 AM
To: File Systems Developers
Subject: [ntfsd] Re: timestamp and backup in file filter

Thank you, Tobias, but what did your last sentence mean? I am a little
lost.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Tobias
Sent: Tuesday, August 19, 2003 11:29 PM
To: File Systems Developers
Subject: [ntfsd] Re: timestamp and backup in file filter

> 1. How can I retrieve the timestamp(last access time, modification
time,
> creation time) of the targeted file in my file filter?

ZwQueryInformationFile() / IRP_MJ_QUERY_INFORMATION

> 2. Whenever I modify and write a file, I try to intercept the IRP
and
store
> the file in different name, so as to keep track of the modification.
How
can
> I do that?

ZwCreateFile() / IRP_MJ_CREATE
ZwReadFile() / IRP_MJ_READ
ZwWriteFile() / IRP_MJ_WRITE

The Zw will be sent to the FS stack, so you’d have to handle the
reentrance
to not back-up your back-up your back-up your back-up.

You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

You are currently subscribed to ntfsd as: xxxxx@exagrid.com
To unsubscribe send a blank email to xxxxx@lists.osr.com