volume name for FSCTL_UNLOCK_VOLUME

NTDEV
1

Hello,

I’m working on a file system filter and I intercept FSCTL_UNLOCK_VOLUME in IRP_MJ_FILE_SYSTEM_CONTROL. Is there any way to extract the name of the volume on which the unlocking operation takes place? I’ve tried ObQueryNameString for the DEVICE_OBJECT and FILE_OBJECT in the IO_STACK_LOCATION structure and it wouldn’t work.

Thanks.

2

You want to post this to the NTFSD list.

NTDEV = General architecture and drivers
NTFSD = Windows file systems and file system filters

Peter
OSR

(p.s. thread locked)