If create operation was initiated by user mode party you will never see
streaming file objects. I’m not sure if you can open NTFS meta data files
from user mode at all. However you can see streaming file objects in your
IRP_MJ_CREATE dispatch routine is there is a filter driver installed on top
of yours and it uses streaming file objects (for example for
IoCancelFileOpen workaround).
You must not prevent NTFS from updating it’s metadata files. It was not
designed for that. On Windows XP and later. You can mount NTFS on read-only
media. There’s no easy way to do that on earlier Windows versions I know of.
-htfv
----- Original Message -----
From: “vincent gambit”
To: “File Systems Developers”
Sent: Friday, August 22, 2003 4:22 AM
Subject: [ntfsd] Re: Windows - Delayed Write Failed
> Hi
>
> thanks for the reply.
> yes, u r right. I saw the stream file objects for NTFS’s metadata files.
> So does that means that other stream file objects not by OS, i will be
able
> to see them in MJ_CREATE?
> For example when user tries to use stream file objects on a NTFS
partition?
> So can I fail these stream file objects for NTFS’s metadata files?
> I do not want the OS to update these metddata files.
>
> Thank You!
>
> cheers,
> vincent
>
>
> >From: “Molly Brown”
> >Reply-To: “File Systems Developers”
> >To: “File Systems Developers”
> >Subject: [ntfsd] Re: Windows - Delayed Write Failed
> >Date: Thu, 21 Aug 2003 08:22:04 -0700
> >
> >You must be seeing the stream file objects for NTFS’s metadata files
> >(like $MFT and $LOGFILE). You will not see IRP_MJ_CREATE operations for
> >these streams as NTFS just uses the stream file object APIs to setup the
> >necessary file objects.
> >
> >Remember, even actions like reads can cause NTFS to have to update its
> >metadata as it will need to update the last access time of the file.
> >
> >Molly Brown
> >Microsoft Corporation
> >
> >This posting is provided “AS IS” with no warranties and confers no
> >rights.
> >
> >
> >-----Original Message-----
> >From: xxxxx@lists.osr.com
> >[mailto:xxxxx@lists.osr.com] On Behalf Of vincent gambit
> >Sent: Wednesday, August 20, 2003 11:02 PM
> >To: File Systems Developers
> >Subject: [ntfsd] Re: Windows - Delayed Write Failed
> >
> >
> >Hi,
> >
> >Thanks for the reply.
> >
> >If thats the case, why I have failed the create operation in
> >IRP_MJ_CREATE path, i still get Stream fileobject in my IRP_MJ_WRITE
> >path?
> >i understand that after a file is opened i can use
> >IoCreateStreamFileObject* from then on.
> >how can i fail these stream fileobject writes or
> >IoCreateStreamFileObject* operation?
> >
> >thank You!
> >
> >cheers,
> >vincent
> >
> > >From: Nick Ryan
> > >Reply-To: “File Systems Developers”
> > >To: “File Systems Developers”
> > >Subject: [ntfsd] Re: Windows - Delayed Write Failed
> > >Date: Wed, 20 Aug 2003 22:33:57 -0700
> > >
> > >No worry; you can’t use IoCreateStreamFileObject* to open a file that
> > >hasn’t already been opened through the standard IRP_MJ_CREATE path.
> > >
> > >vincent gambit wrote:
> > >
> > >>
> > >>
> > >>Hi,
> > >>
> > >>Thanks for your reply.
> > >>
> > >>I guess I have trouble as I don’t data changes on a NTFS media.
> > >>I have failed Create but I was afraid a user may use
> > >>IoCreateStreamFileObject or IoCreateStreamFileObjectLite then I will
> > >>not be able to fail these create processes in MJ_CREATE.
> > >>8(
> > >>
> > >>Or is there a way to fail these 2 create operations?
> > >>
> > >>Thank You!
> > >>
> > >>cheers,
> > >>vincent
> > >>
> > >>>From: “Alexey Logachyov”
> > >>>Reply-To: “File Systems Developers”
> > >>>To: “File Systems Developers”
> > >>>Subject: [ntfsd] Re: Windows - Delayed Write Failed
> > >>>Date: Thu, 21 Aug 2003 02:42:38 +0300
> > >>>
> > >>>Never fail writes. You may break functionality OS relies on. As far
> > >>>as I know, on Windows XP and later you can mount NTFS on read-only
> > >>>volume. On earlier Windows version there’s no way to make NTFS not
> >write anything.
> > >>>You
> > >>>may try to redirect writes to some special storage (which is not very
> >
> > >>>easy to implement 
but not fail them. And not ignore them (i.e. not
> >
> > >>>pass them down but return STATUS_SUCCESS). That will make system very
> >
> > >>>unhappy.
> > >>>
> > >>>What are you trying to make? If you need to protected files from
> > >>>modifying by users, you can fail creates only. If you don’t want data
> >
> > >>>changes on media, you have a trouble. At least with NTFS.
> > >>>
> > >>>-htfv
> > >>>
> > >>>
> > >>>
> > >>>----- Original Message -----
> > >>>From: “vincent gambit”
> > >>>To: “File Systems Developers”
> > >>>Sent: Wednesday, August 20, 2003 8:09 PM
> > >>>Subject: [ntfsd] Re: Windows - Delayed Write Failed
> > >>>
> > >>>
> > >>> > hi
> > >>> >
> > >>> > thanks for your reply.
> > >>> >
> > >>> > But I notice that streaming file object writes does not go through
> >
> > >>> > FastIOWrites.
> > >>> >
> > >>> > so does that means that i will not able to fail a streaming file
> > >>>writes
> > >>> > without the delay write error message?
> > >>> >
> > >>> > thank you
> > >>> >
> > >>> > cheers,
> > >>> > vincent
> > >>> >
> > >>> > >From: “Tom Hansen”
> > >>> > >Reply-To: “File Systems Developers”
> > >>> > >To: “File Systems Developers”
> > >>> > >Subject: [ntfsd] Re: Windows - Delayed Write Failed
> > >>> > >Date: Wed, 20 Aug 2003 11:22:55 -0400
> > >>> > >
> > >>> > >If you want to fail a request prior to data being written to the
> > >>>cache
> > >>> > >manager, you should just return FALSE to the fast i/o dispatch
> > >>>routine
> > >>> > >and just fail the IRP_MJ_WRITE IRP that you should see on your
> > >>> > >file object.
> > >>> > >
> > >>> > >/TomH
> > >>> > >
> > >>> > >-----Original Message-----
> > >>> > >From: vincent gambit [mailto:xxxxx@hotmail.com]
> > >>> > >Sent: Wednesday, August 20, 2003 3:37 AM
> > >>> > >To: File Systems Developers
> > >>> > >Subject: [ntfsd] Re: Windows - Delayed Write Failed
> > >>> > >
> > >>> > >Hi,
> > >>> > >
> > >>> > >Thanks for your reply
> > >>> > >I have checked.
> > >>> > >It is for streaming file object for IRP_MJ_WRITE request.
> > >>> > >So does these streaming file object writes goes through FastIO?
> > >>> > >Is it possible to fail these streaming file object writes at the
> > >>> > >file system before it does the actual writes to the device?
> > >>> > >
> > >>> > >Thank You!
> > >>> > >
> > >>> > >cheers,
> > >>> > >vincent
> > >>> > >
> > >>> > >
> > >>> > > >From: “Alexey Logachyov”
> > >>> > > >Reply-To: “File Systems Developers”
> > >>> > > >To: “File Systems Developers”
> > >>> > > >Subject: [ntfsd] Re: Windows - Delayed Write Failed
> > >>> > > >Date: Tue, 19 Aug 2003 13:15:32 +0300
> > >>> > > >
> > >>> > > >Check if IRP_MJ_WRITE request comes for streaming file object.
> > >>> > > >NTFS
> > >>>may
> > >>> > > >create file objects for its own internal use. I will not see
> > >>> > >IRP_MJ_CREATE
> > >>> > > >for those but you may see other operations. Anyway, I don’t
> > >>> > > >think
> > >>>that
> > >>> > > >failing write requests is a good idea. As you said, you’re
> > >>> > > >failing
> > >>> > >creates,
> > >>> > > >so why bother with writes if no file can be opened.
> > >>> > > >
> > >>> > > >-htfv
> > >>> > > >
> > >>> > > >
> > >>> > > >
> > >>> > > >----- Original Message -----
> > >>> > > >From: “vincent gambit”
> > >>> > > >To: “File Systems Developers”
> > >>> > > >Sent: Tuesday, August 19, 2003 9:28 AM
> > >>> > > >Subject: [ntfsd] Windows - Delayed Write Failed
> > >>> > > >
> > >>> > > >
> > >>> > > > > Hi,
> > >>> > > > >
> > >>> > > > > Using sfilter in IFSKit as a sample, when I tried to return
> > >>> > > > > a STATUS_ACCESS_DENIED in both SfCreate and MJ_WRITE, I will
> >
> > >>> > > > > get
> > >>>the
> > >>> > >error
> > >>> > > > > message: “Windows - Delayed Write Failed” if the hard disk
> > >>> > > > > is a
> > >>>NTFS
> > >>> > > > > partition. However this error message will not appear for
> > >>> > > > > normal
> > >>>FAT
> > >>> > > > > partition but the write operation will fail.
> > >>> > > > > Why is that so?
> > >>> > > > > What I don’t understand is, why I have failed the SfCreate
> > >>>process,
> > >>> > >it
> > >>> > > >still
> > >>> > > > > goes to MJ_WRITE?
> > >>> > > > > So it is possible to write to a disk without using
> > >>> > > > > CreateFile or ZwCreateFile?
> > >>> > > > >
> > >>> > > > > I would like to know is it possible to prevent this error
> > >>>message
> > >>> > >from
> > >>> > > > > appearing?
> > >>> > > > >
> > >>> > > > > Thank You!
> > >>> > > > >
> > >>> > > > > cheers,
> > >>> > > > > vincent
> > >>> > > > >
> > >>> > > > >
> > >>>
> > >>> > > > > Get MSN 8 and help protect your children with
> > >>> > > > > advanced
> > >>> > >parental
> > >>> > > > > controls. http://join.msn.com/?page=features/parental
> > >>> > > > >
> > >>> > > > >
> > >>> > > > >
> > >>> > > > > —
> > >>> > > > > You are currently subscribed to ntfsd as: xxxxx@vba.com.by To
> >
> > >>> > > > > unsubscribe send a blank email to
> > >>>xxxxx@lists.osr.com
> > >>> > > > >
> > >>> > > > >
> > >>> > > >
> > >>> > > >
> > >>> > > >
> > >>> > > >
> > >>> > > >—
> > >>> > > >You are currently subscribed to ntfsd as:
> > >>> > > >xxxxx@hotmail.com To unsubscribe send a blank email to
> > >>>xxxxx@lists.osr.com
> > >>> > >
> > >>> > >
> > >>> > >Send a fun phone greeting to your friend!
> > >>> > >http://www.msn.com.sg/mobile/fungreetings/
> > >>> > >
> > >>> > >
> > >>> > >
> > >>> > >—
> > >>> > >You are currently subscribed to ntfsd as: xxxxx@exagrid.com To
> > >>> > >unsubscribe send a blank email to xxxxx@lists.osr.com
> > >>> > >
> > >>> > >
> > >>> > >—
> > >>> > >You are currently subscribed to ntfsd as: xxxxx@hotmail.com
> >
> > >>> > >To unsubscribe send a blank email to
> > >>> > >xxxxx@lists.osr.com
> > >>> >
> > >>> >
> > >>> > Get 10mb of inbox space with MSN Hotmail Extra Storage
> > >>> > http://join.msn.com/?pgmarket=en-sg at only S$36 including GST
> > >>> >
> > >>> >
> > >>> >
> > >>> > —
> > >>> > You are currently subscribed to ntfsd as: xxxxx@vba.com.by To
> > >>> > unsubscribe send a blank email to xxxxx@lists.osr.com
> > >>> >
> > >>> >
> > >>>
> > >>>
> > >>>
> > >>>
> > >>>—
> > >>>You are currently subscribed to ntfsd as: xxxxx@hotmail.com To
> > >>>unsubscribe send a blank email to xxxxx@lists.osr.com
> > >>
> > >>
> > >>
> > >>Send a fun phone greeting to your friend!
> > >>http://www.msn.com.sg/mobile/fungreetings/
> > >>
> > >>
> > >>
> > >>
> > >
> > >–
> > >Nick Ryan (MVP for DDK)
> > >
> > >
> > >—
> > >You are currently subscribed to ntfsd as: xxxxx@hotmail.com To
> > >unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >
> >Take a break! Find destinations on MSN Travel.
> >http://www.msn.com.sg/travel/
> >
> >
> >
> >—
> >You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
> >To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >
> >
> >—
> >You are currently subscribed to ntfsd as: xxxxx@hotmail.com
> >To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
> Get 10mb of inbox space with MSN Hotmail Extra Storage
> http://join.msn.com/?pgmarket=en-sg at only S$36 including GST
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>