use the minifilter to encrypt the database such as mysql

NTFSD
1

Has someone did like this? The mysql created two files, one is .frm file that is the table informaion file, another is the ibdata1 file that is the true data file. When I encrypt the .frm file, I alway got the error “ERROR 1033 (HY000):Incorrect information in file:‘.\data1\user7.frm’”. I hope someone could help me.

2

This obviously means that you are not able to present the plaintext data properly to the application. I suggest that you put a break point in the read path and check the contents post decryption. Also, try to match it with the data that you see without your encryption stuff in place.

On 10-Mar-2014, at 9:45 am, xxxxx@gmail.com wrote:

Has someone did like this? The mysql created two files, one is .frm file that is the table informaion file, another is the ibdata1 file that is the true data file. When I encrypt the .frm file, I alway got the error “ERROR 1033 (HY000):Incorrect information in file:‘.\data1\user7.frm’”. I hope someone could help me.

NTFSD is sponsored by OSR

OSR is hiring!! Info at http://www.osr.com/careers

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

thanks, Ayush
My program work well for txt and word files,but not for .frm. Another question, mysql data files ibdata1 do not create the IRP_MJ_CREATE flags, only monitored the IRP_MJ_WRITE flags when use FileSpy. Is it use the different way to read and write files?

4

I think MySQL/MyISAM (don’t know on InnoDB) uses calls like fopen/fread/frwrite for all its file access.

–
Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com

wrote in message news:xxxxx@ntfsd…
> thanks, Ayush
> My program work well for txt and word files,but not for .frm. Another question, mysql data files ibdata1 do not create the IRP_MJ_CREATE flags, only monitored the IRP_MJ_WRITE flags when use FileSpy. Is it use the different way to read and write files?
>

5

Do you mean you are not seeing IRP_MJ_CREATE for these files and directly an IRP_MJ_WRITE? That simply can’t happen. There has to be an IRP_MJ_CREATE. Is it possible that the IRP_MJ_CREATE was sent well before you started the trace using FileSpy and hence you did not see that using FileSpy?

Ayush Gupta
AI Consulting

6

thanks Ayush. I have got a new problem. when I open and close a .doc file that was encryped, then it can not be closed. when user FileSpy monitor it ,I find the error:
16 14:13:24.800 WINWORD.EXE FASTIO_QUERY_BASIC_INFO 966D4598 E:\asd.doc FAILURE
17 14:13:24.800 WINWORD.EXE IRP_MJ_QUERY_INFORMATION 00060870 966D4598 E:\asd.doc STATUS_SUCCESS FileBasicInformation
18 14:13:24.800 WINWORD.EXE FASTIO_UNLOCK_SINGLE 966D4598 E:\asd.doc FAILURE ByteOffset: 00000000-7FFFFF93 Key: N/A
19 14:13:24.800 WINWORD.EXE IRP_MJ_LOCK_CONTROL/IRP_MN_UNLOCK_SINGLE 00060000 966D4598 E:\asd.doc STATUS_SUCCESS
20 14:13:24.800 WINWORD.EXE FASTIO_UNLOCK_SINGLE 966D4598 E:\asd.doc FAILURE ByteOffset: 00000000-7FFFFFA7 Key: N/A
21 14:13:24.800 WINWORD.EXE IRP_MJ_LOCK_CONTROL/IRP_MN_UNLOCK_SINGLE 00060000 966D4598 E:\asd.doc STATUS_SUCCESS
22 14:13:24.800 WINWORD.EXE FASTIO_UNLOCK_SINGLE 966D4598 E:\asd.doc FAILURE ByteOffset: 00000000-7FFFFFCF Key: N/A
23 14:13:24.800 WINWORD.EXE IRP_MJ_LOCK_CONTROL/IRP_MN_UNLOCK_SINGLE 00060000 966D4598 E:\asd.doc STATUS_SUCCESS
How can i solve it

7

It may be locked and cannot be unlock. I have never come across such a problem. I hope someone give me an idea.

8

What is the exact failure code?

On 15-Mar-2014, at 2:10 pm, xxxxx@gmail.com wrote:

It may be locked and cannot be unlock. I have never come across such a problem. I hope someone give me an idea.

NTFSD is sponsored by OSR

OSR is hiring!! Info at http://www.osr.com/careers

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

9

It is not have failure code. Normally, when i monitor the open and close the doc file,i will be end with IRP_MJ_CLEANUP and IRP_MJ_CLOSE. But now when i hit the close button , the doc file has ‘No response’ error ,and it is end with IRP_MJ_LOCK_CONTROL/IRP_MN_UNLOCK_SINGLE, such as mentioned above.

10

So you have a thread waiting in MJ_CLEANUP or some such. What does the
debugger say?