upper filter, decryption information

NTFSD
1

i want to decrypt files on a usb mass storage device, before
i start i want to clarify a few things. this is for a upper
file system filter driver for a usb mass storage device.

when a irp_mjr_read is sent from the i/o manager to drivers
for a usb mass storage device, data is being requested from
the usb device correct ? to be sent to user buffers or being
used to store for the nt cache manager correct ?.

fastio operations in relation to my filter driver are
requests that get sent to my driver and the fastio read and
write are accesing the data in the cache if no data is in
the cache then a irp_mjr_read is sent to my filter driver ?

so in conclusion to make sure all reading of files is
detected from my driver and decrypted is to decrypt all the
data in relation to the irp_mjr_read, so i don’t care about
decrypting fastio data ? (as it has already been decrypted
via the irp_mjr_read done by the upper filter driver when nt
cache manager requested the data).

thanks in advance.

2

  1. For IRP_MJ_READ data is placed in request buffer( contained in IRP ) and
    may be placed in cache, because CcCopyRead can be used to read data from
    cache.

  2. Correct. If data is not contained in cache then IRP_MJ_READ with
    IRP_PAGING_IO flag is sent.

  3. Correct for FastIo but incorrect for IRP_MJ_READ. IRP_MJ_READ without
    IRP_PAGING_IO flag may use CcCopyRead to read data from cache. You will
    decrypt data twice if you will decrypt data for each IRP_MJ_READ.

wrote in message news:xxxxx@ntfsd…
>i want to decrypt files on a usb mass storage device, before
> i start i want to clarify a few things. this is for a upper
> file system filter driver for a usb mass storage device.
>
> when a irp_mjr_read is sent from the i/o manager to drivers
> for a usb mass storage device, data is being requested from
> the usb device correct ? to be sent to user buffers or being
> used to store for the nt cache manager correct ?.
>
> fastio operations in relation to my filter driver are
> requests that get sent to my driver and the fastio read and
> write are accesing the data in the cache if no data is in
> the cache then a irp_mjr_read is sent to my filter driver ?
>
> so in conclusion to make sure all reading of files is
> detected from my driver and decrypted is to decrypt all the
> data in relation to the irp_mjr_read, so i don’t care about
> decrypting fastio data ? (as it has already been decrypted
> via the irp_mjr_read done by the upper filter driver when nt
> cache manager requested the data).
>
> thanks in advance.
>

3

Use the disk-level block-wise crypto and forget FastIO forever.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From:
To: “Windows File Systems Devs Interest List”
Sent: Tuesday, August 09, 2005 7:09 PM
Subject: [ntfsd] upper filter, decryption information

> i want to decrypt files on a usb mass storage device, before
> i start i want to clarify a few things. this is for a upper
> file system filter driver for a usb mass storage device.
>
> when a irp_mjr_read is sent from the i/o manager to drivers
> for a usb mass storage device, data is being requested from
> the usb device correct ? to be sent to user buffers or being
> used to store for the nt cache manager correct ?.
>
> fastio operations in relation to my filter driver are
> requests that get sent to my driver and the fastio read and
> write are accesing the data in the cache if no data is in
> the cache then a irp_mjr_read is sent to my filter driver ?
>
> so in conclusion to make sure all reading of files is
> detected from my driver and decrypted is to decrypt all the
> data in relation to the irp_mjr_read, so i don’t care about
> decrypting fastio data ? (as it has already been decrypted
> via the irp_mjr_read done by the upper filter driver when nt
> cache manager requested the data).
>
> thanks in advance.
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

4

use a disk low level filter driver to decrypt the data ?

---- Original message ----

Date: Tue, 9 Aug 2005 23:32:27 +0400
From: “Maxim S. Shatskih”
>Subject: Re: [ntfsd] upper filter, decryption information
>To: “Windows File Systems Devs Interest List”

>
> Use the disk-level block-wise crypto and forget FastIO
forever.
>
>Maxim Shatskih, Windows DDK MVP
>StorageCraft Corporation
>xxxxx@storagecraft.com
>http://www.storagecraft.com
>
>----- Original Message -----
>From:
>To: “Windows File Systems Devs Interest List”

>Sent: Tuesday, August 09, 2005 7:09 PM
>Subject: [ntfsd] upper filter, decryption information
>
>
>> i want to decrypt files on a usb mass storage device,
before
>> i start i want to clarify a few things. this is for a
upper
>> file system filter driver for a usb mass storage device.
>>
>> when a irp_mjr_read is sent from the i/o manager to
drivers
>> for a usb mass storage device, data is being requested
from
>> the usb device correct ? to be sent to user buffers or
being
>> used to store for the nt cache manager correct ?.
>>
>> fastio operations in relation to my filter driver are
>> requests that get sent to my driver and the fastio read
and
>> write are accesing the data in the cache if no data is in
>> the cache then a irp_mjr_read is sent to my filter
driver ?
>>
>> so in conclusion to make sure all reading of files is
>> detected from my driver and decrypted is to decrypt all
the
>> data in relation to the irp_mjr_read, so i don’t care
about
>> decrypting fastio data ? (as it has already been decrypted
>> via the irp_mjr_read done by the upper filter driver when
nt
>> cache manager requested the data).
>>
>> thanks in advance.
>>
>> —
>> Questions? First check the IFS FAQ at
>https://www.osronline.com/article.cfm?id=17
>>
>> You are currently subscribed to ntfsd as:
xxxxx@storagecraft.com
>> To unsubscribe send a blank email to leave-ntfsd-
xxxxx@lists.osr.com
>
>
>—
>Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: xxxxx@uow.edu.au
>To unsubscribe send a blank email to leave-ntfsd-
xxxxx@lists.osr.com

5

what exactly u want to do will determine where the driver is palced.
maxim’s solution will work, but then you if place your driver below
the fsd driver, then you will have no clue about *files*.

Do you simply want to encrypt files, or even the disk structures?

On 8/10/05, xxxxx@uow.edu.au wrote:
> use a disk low level filter driver to decrypt the data ?
>
> ---- Original message ----
> >Date: Tue, 9 Aug 2005 23:32:27 +0400
> >From: “Maxim S. Shatskih”
> >Subject: Re: [ntfsd] upper filter, decryption information
> >To: “Windows File Systems Devs Interest List”
>
> >
> > Use the disk-level block-wise crypto and forget FastIO
> forever.
> >
> >Maxim Shatskih, Windows DDK MVP
> >StorageCraft Corporation
> >xxxxx@storagecraft.com
> >http://www.storagecraft.com
> >
> >----- Original Message -----
> >From:
> >To: “Windows File Systems Devs Interest List”
>
> >Sent: Tuesday, August 09, 2005 7:09 PM
> >Subject: [ntfsd] upper filter, decryption information
> >
> >
> >> i want to decrypt files on a usb mass storage device,
> before
> >> i start i want to clarify a few things. this is for a
> upper
> >> file system filter driver for a usb mass storage device.
> >>
> >> when a irp_mjr_read is sent from the i/o manager to
> drivers
> >> for a usb mass storage device, data is being requested
> from
> >> the usb device correct ? to be sent to user buffers or
> being
> >> used to store for the nt cache manager correct ?.
> >>
> >> fastio operations in relation to my filter driver are
> >> requests that get sent to my driver and the fastio read
> and
> >> write are accesing the data in the cache if no data is in
> >> the cache then a irp_mjr_read is sent to my filter
> driver ?
> >>
> >> so in conclusion to make sure all reading of files is
> >> detected from my driver and decrypted is to decrypt all
> the
> >> data in relation to the irp_mjr_read, so i don’t care
> about
> >> decrypting fastio data ? (as it has already been decrypted
> >> via the irp_mjr_read done by the upper filter driver when
> nt
> >> cache manager requested the data).
> >>
> >> thanks in advance.
> >>
> >> —
> >> Questions? First check the IFS FAQ at
> >https://www.osronline.com/article.cfm?id=17
> >>
> >> You are currently subscribed to ntfsd as:
> xxxxx@storagecraft.com
> >> To unsubscribe send a blank email to leave-ntfsd-
> xxxxx@lists.osr.com
> >
> >
> >—
> >Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
> >
> >You are currently subscribed to ntfsd as: xxxxx@uow.edu.au
> >To unsubscribe send a blank email to leave-ntfsd-
> xxxxx@lists.osr.com
>
> —
> Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

–

- Developer

6

You may get file bitmap using defragment API, for example, VolSnap uses the
one.

“Developer” wrote in message news:xxxxx@ntfsd…
what exactly u want to do will determine where the driver is palced.
maxim’s solution will work, but then you if place your driver below
the fsd driver, then you will have no clue about files.

Do you simply want to encrypt files, or even the disk structures?

On 8/10/05, xxxxx@uow.edu.au wrote:
> use a disk low level filter driver to decrypt the data ?
>
> ---- Original message ----
> >Date: Tue, 9 Aug 2005 23:32:27 +0400
> >From: “Maxim S. Shatskih”
> >Subject: Re: [ntfsd] upper filter, decryption information
> >To: “Windows File Systems Devs Interest List”
>
> >
> > Use the disk-level block-wise crypto and forget FastIO
> forever.
> >
> >Maxim Shatskih, Windows DDK MVP
> >StorageCraft Corporation
> >xxxxx@storagecraft.com
> >http://www.storagecraft.com
> >
> >----- Original Message -----
> >From:
> >To: “Windows File Systems Devs Interest List”
>
> >Sent: Tuesday, August 09, 2005 7:09 PM
> >Subject: [ntfsd] upper filter, decryption information
> >
> >
> >> i want to decrypt files on a usb mass storage device,
> before
> >> i start i want to clarify a few things. this is for a
> upper
> >> file system filter driver for a usb mass storage device.
> >>
> >> when a irp_mjr_read is sent from the i/o manager to
> drivers
> >> for a usb mass storage device, data is being requested
> from
> >> the usb device correct ? to be sent to user buffers or
> being
> >> used to store for the nt cache manager correct ?.
> >>
> >> fastio operations in relation to my filter driver are
> >> requests that get sent to my driver and the fastio read
> and
> >> write are accesing the data in the cache if no data is in
> >> the cache then a irp_mjr_read is sent to my filter
> driver ?
> >>
> >> so in conclusion to make sure all reading of files is
> >> detected from my driver and decrypted is to decrypt all
> the
> >> data in relation to the irp_mjr_read, so i don’t care
> about
> >> decrypting fastio data ? (as it has already been decrypted
> >> via the irp_mjr_read done by the upper filter driver when
> nt
> >> cache manager requested the data).
> >>
> >> thanks in advance.
> >>
> >> —
> >> Questions? First check the IFS FAQ at
> >https://www.osronline.com/article.cfm?id=17
> >>
> >> You are currently subscribed to ntfsd as:
> xxxxx@storagecraft.com
> >> To unsubscribe send a blank email to leave-ntfsd-
> xxxxx@lists.osr.com
> >
> >
> >—
> >Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
> >
> >You are currently subscribed to ntfsd as: xxxxx@uow.edu.au
> >To unsubscribe send a blank email to leave-ntfsd-
> xxxxx@lists.osr.com
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

–

- Developer

7

is there a skeleton example for a upper-filter driver for a
storage device (usb mass storage device, should not matter
its fat disk). i edited diskperf with dbgprint()'s and added
diskperf as a upperfilter driver for my usb disk but when i
go to device manager i get “Windows successfully loaded the
device driver for this hardware but cannot find the hardware
device. (Code 41)”.

---- Original message ----

Date: Wed, 10 Aug 2005 16:41:22 +0400
From: “Slava Imameyev”
>Subject: Re:[ntfsd] upper filter, decryption information
>To: “Windows File Systems Devs Interest List”

>
>You may get file bitmap using defragment API, for example,
VolSnap uses the
>one.
>
>“Developer” wrote in message
news:xxxxx@ntfsd…
>what exactly u want to do will determine where the driver is
palced.
>maxim’s solution will work, but then you if place your
driver below
>the fsd driver, then you will have no clue about files.
>
>Do you simply want to encrypt files, or even the disk
structures?
>
>
>
>
>
>On 8/10/05, xxxxx@uow.edu.au wrote:
>> use a disk low level filter driver to decrypt the data ?
>>
>> ---- Original message ----
>> >Date: Tue, 9 Aug 2005 23:32:27 +0400
>> >From: “Maxim S. Shatskih”
>> >Subject: Re: [ntfsd] upper filter, decryption information
>> >To: “Windows File Systems Devs Interest List”
>>
>> >
>> > Use the disk-level block-wise crypto and forget FastIO
>> forever.
>> >
>> >Maxim Shatskih, Windows DDK MVP
>> >StorageCraft Corporation
>> >xxxxx@storagecraft.com
>> >http://www.storagecraft.com
>> >
>> >----- Original Message -----
>> >From:
>> >To: “Windows File Systems Devs Interest List”
>>
>> >Sent: Tuesday, August 09, 2005 7:09 PM
>> >Subject: [ntfsd] upper filter, decryption information
>> >
>> >
>> >> i want to decrypt files on a usb mass storage device,
>> before
>> >> i start i want to clarify a few things. this is for a
>> upper
>> >> file system filter driver for a usb mass storage device.
>> >>
>> >> when a irp_mjr_read is sent from the i/o manager to
>> drivers
>> >> for a usb mass storage device, data is being requested
>> from
>> >> the usb device correct ? to be sent to user buffers or
>> being
>> >> used to store for the nt cache manager correct ?.
>> >>
>> >> fastio operations in relation to my filter driver are
>> >> requests that get sent to my driver and the fastio read
>> and
>> >> write are accesing the data in the cache if no data is
in
>> >> the cache then a irp_mjr_read is sent to my filter
>> driver ?
>> >>
>> >> so in conclusion to make sure all reading of files is
>> >> detected from my driver and decrypted is to decrypt all
>> the
>> >> data in relation to the irp_mjr_read, so i don’t care
>> about
>> >> decrypting fastio data ? (as it has already been
decrypted
>> >> via the irp_mjr_read done by the upper filter driver
when
>> nt
>> >> cache manager requested the data).
>> >>
>> >> thanks in advance.
>> >>
>> >> —
>> >> Questions? First check the IFS FAQ at
>> >https://www.osronline.com/article.cfm?id=17
>> >>
>> >> You are currently subscribed to ntfsd as:
>> xxxxx@storagecraft.com
>> >> To unsubscribe send a blank email to leave-ntfsd-
>> xxxxx@lists.osr.com
>> >
>> >
>> >—
>> >Questions? First check the IFS FAQ at
>> https://www.osronline.com/article.cfm?id=17
>> >
>> >You are currently subscribed to ntfsd as: xxxxx@uow.edu.au
>> >To unsubscribe send a blank email to leave-ntfsd-
>> xxxxx@lists.osr.com
>>
>> —
>> Questions? First check the IFS FAQ at
>> https://www.osronline.com/article.cfm?id=17
>>
>> You are currently subscribed to ntfsd as:
xxxxx@gmail.com
>> To unsubscribe send a blank email to leave-ntfsd-
xxxxx@lists.osr.com
>>
>
>
>–
>
>- Developer
>
>
>
>—
>Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: xxxxx@uow.edu.au
>To unsubscribe send a blank email to leave-ntfsd-
xxxxx@lists.osr.com