Which filter driver to make for a recovery software?

NTFSD
1

Hi all,
I am planning to make a recovery software, which will rollback the system to some previous state after a crash or a virus attack.
To the best of my knowledge i think that a volume filter driver should be implemented.
Is there any sample available in IFS / DDK that illustrates the procedure of handling read / write requests in the Volume filter driver?
Are there other references?

Thanks in advance.
Ayush Gupta

2

Look at the diskperf example - it sits on top of disk volumes. NTDEV is
also a better group for questions of this type (below the FSD level
where the world is a block device.)

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@yahoo.com
Sent: Tuesday, July 25, 2006 1:46 AM
To: ntfsd redirect
Subject: [ntfsd] Which filter driver to make for a recovery software?

Hi all,
I am planning to make a recovery software, which will rollback the
system to some previous state after a crash or a virus attack.
To the best of my knowledge i think that a volume filter driver should
be implemented.
Is there any sample available in IFS / DDK that illustrates the
procedure of handling read / write requests in the Volume filter driver?
Are there other references?

Thanks in advance.
Ayush Gupta

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Volume filter is the best way to implement this. Check the FileDisk in
http://www.acc.umu.se/~bosse/

Not really a filter sample, but answer many questions…

~Sisimon

On 7/25/06, xxxxx@yahoo.com wrote:
>
> Hi all,
> I am planning to make a recovery software, which will rollback the system
> to some previous state after a crash or a virus attack.
> To the best of my knowledge i think that a volume filter driver should be
> implemented.
> Is there any sample available in IFS / DDK that illustrates the procedure
> of handling read / write requests in the Volume filter driver?
> Are there other references?
>
> Thanks in advance.
> Ayush Gupta
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

–
GCS d+ s: a- c++++ U> B+ L++>$ w++++$ W++(+++) PGP+N+ t PS+PE++ tv+(++) b+++
G+++ e++>(++++) h-- r
Don’t know this? See http://www.geekcode.com/geek.html

4

I think a disk filter driver is not power enough. Maybe ghost is needed. :-p

дÈëÏûÏ¢ÐÂÎÅ:xxxxx@ntfsd…
> Hi all,
> I am planning to make a recovery software, which will rollback the system
> to some previous state after a crash or a virus attack.
> To the best of my knowledge i think that a volume filter driver should be
> implemented.
> Is there any sample available in IFS / DDK that illustrates the procedure
> of handling read / write requests in the Volume filter driver?
> Are there other references?
>
> Thanks in advance.
> Ayush Gupta
>

5

Hey, what does a ghost mean? Can i modify the DiskPerf example for this purpose ?
DiskPerf tracks the no. of read/write requests etc.
Any suggestions for implementing the project?
Any special features that can be given?
The project is still in the requirement analysis and design phase…

6
  1. Ghost is a disk replication(image) software by Symantec.
  2. If I remember correctly, Microsoft’s own implementation included (system
    restore) an FS filter also. Heard it one of the Channel 9 discussions with
    Molly Brown.