Tracking when an application is accessing a file

NTFSD
1

Guys,

I am developing a file collabration application that synchronizes access to
files. The purpose is to prevent another application from modifying a file
while another application is modfying it.

For example: when a user is accessing the file with wordpad.exe I want to
prevent the same file from being accessed by MSWord.exe.

However, if I monitor the file IO activity using a file system filter driver
I will typically see the following:
File Open
File Read
File Close
.
.
.
File Open
File Write
File Close

Thus the application does not hold a handle to the file so I can’t use the
IO activity to definitivily tell when a file is in “use” or not. “use” in
this case means that the user is viewing/modifying the files content in some
editor.

Question:
Does anyone know of a way to detect when a specific Process/Thread is
“using” a file and when it has finished “using” the file.

All input will be greatly appreciated.

TIA,
J

2

Reboot the system after each file you care about is closed. I can’t think
of any other way to know for sure.

  1. Ensuring that the program/process that opened the file has terminated
    will work, but it could be that the program is really done with the file and
    is working on another file.
  2. You can’t use the fact that it opened another file since it could be a
    ‘read/merge’ of a second file into the first file that will be saved
    sometime in the future.

“jjjames1” wrote in message news:xxxxx@ntfsd…
> Guys,
>
> I am developing a file collabration application that synchronizes access
> to files. The purpose is to prevent another application from modifying a
> file while another application is modfying it.
>
> For example: when a user is accessing the file with wordpad.exe I want to
> prevent the same file from being accessed by MSWord.exe.
>
> However, if I monitor the file IO activity using a file system filter
> driver I will typically see the following:
> File Open
> File Read
> File Close
> .
> .
> .
> File Open
> File Write
> File Close
>
> Thus the application does not hold a handle to the file so I can’t use the
> IO activity to definitivily tell when a file is in “use” or not. “use” in
> this case means that the user is viewing/modifying the files content in
> some editor.
>
> Question:
> Does anyone know of a way to detect when a specific Process/Thread is
> “using” a file and when it has finished “using” the file.
>
> All input will be greatly appreciated.
>
>
> TIA,
> J
>
>

3

PEPROCESS IoGetRequestorProcess(IN PIRP Irp);
might help you with this issue or
ULONG IoGetRequestorProcessId(
IN PIRP Irp
);

or
PEPROCESS IoGetCurrentProcess()

4

Thanks but the problem isn’t know which process/thread is accessing the
file. The problem is detecting when the process/thread is done with the
file.

wrote in message news:xxxxx@ntfsd…
> PEPROCESS IoGetRequestorProcess(IN PIRP Irp);
> might help you with this issue or
> ULONG IoGetRequestorProcessId(
> IN PIRP Irp
> );
>
> or
> PEPROCESS IoGetCurrentProcess()
>

5

David’s comment is correct if your problem statement was meant to describe a
general facility for any application. But you said you were developing a
“file collabration application” - I’m not sure what that means. Does your
“file collabration application” provide the interface through which this
collaboration occurs, or is it simply supposed to receive notifications from
your filter driver regarding the activities of other random applications?

The system itself provides ‘file collaboration’ through ‘share access’ and
‘byte range locking’. These are the defined mechanisms that win32
applications understand and use to control concurrent access to file data.

On Feb 17, 2008 10:02 AM, jjjames1 wrote:

> Thanks but the problem isn’t know which process/thread is accessing the
> file. The problem is detecting when the process/thread is done with the
> file.
>
> wrote in message news:xxxxx@ntfsd…
> > PEPROCESS IoGetRequestorProcess(IN PIRP Irp);
> > might help you with this issue or
> > ULONG IoGetRequestorProcessId(
> > IN PIRP Irp
> > );
> >
> > or
> > PEPROCESS IoGetCurrentProcess()
> >
>
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@hollistech.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

–
Mark Roddy

6

jjjames1 wrote:

Thanks but the problem isn’t know which process/thread is accessing the
file. The problem is detecting when the process/thread is done with the
file.

That information is absolutely impossible to know without the
cooperation of the application itself.

As far as the OS is concerned when a file is closed the application is
done with it. That’s as much as you know.

Tony