Hi all,
This is my first mail to this list. I am working on file backup tool.
For this i need to take the backup of exclusively open files also.
I search on google to take the backup of open file then i came to know that
i will have to write the file system filter driver for this. Can any one
help me out that what are the functions to be use to copy the open files
I have tried zwCreateFile function but it’s not working.
Regards
Navdeep
Navdeep wrote:
Hi all,
This is my first mail to this list. I am working on file backup tool.
For this i need to take the backup of exclusively open files also.
I search on google to take the backup of open file then i came to know that
i will have to write the file system filter driver for this. Can any one
help me out that what are the functions to be use to copy the open filesI have tried zwCreateFile function but it’s not working.
Regards
MMM tell me if I’m wrong, but what you want to do is to make a copy of a
file each time it is opened, whatever the access? Do you want to make
the copy before or after any read/write?
If you want to backup before any read/write, simply filter all
IRP_MJ_CREATE on the devices you’re interested in, and make a copy with
Zw* at this time. You’ll have to be in PASSIVE_LEVEL, but AFAIK
IRP_MJ_CREATE occurs at this IRQL (correct me if I’m wrong). The sfilter
example in the IFS DDK is a good starting point. Just make sure that the
creation request is not for a new file, otherwise you’re going to copy
empty files. 
If you want to backup after the read/write, add the PFILE_OBJECT to a
driver maintained structure at IRP_MJ_CREATE, monitor potential
IRP_MJ_WRITE to this PFILE_OBJECT and flag it “dirty” if one occurs. At
IRP_MJ_CLOSE, simply backup dirty files.
One little trick for this latter exercice : because of the streams,
you’ll have to monitor and add to your collection new PFILE_OBJECTs
which have the same FCB than the one you’re monitoring.
Hope it’s helpful.
–
Edouard
> MMM tell me if I’m wrong, but what you want to do is to make a copy of a
file each time it is opened, whatever the access? Do you want to make
the copy before or after any read/write?
I think Navdeep wants to be able to back up the files that are
currently opened exclusively.
To achieve that you can detect such opens in IRP_MJ_CREATE and change
the open options. Therefore another application will be able to open
the file in parallel. But you have to be aware of consequences of
changing the open options. I think you should then filter out (deny)
all further opens (except for your backup tool) until the exclusively
opened file is closed.
But anyhow you will have problems the file is being written/read using
memory mapped access.
Regards,
Urban
Hi Edouard,
i simply want to take the backup of system files which have been exclusively opened and locked by windows for its own purpose.Now when windows opens any of its system files with the intention of writing to it uses a mutex kind of mechanism in order to make sure that any user mode/kernel mode process cannot access that file.
I just want to know that whether it is possible to momentarily bypass that locking mechanism of windows to read the current run time image of that file(like registry files SAM, SECURITY, ntuser.dat etc).
regards
Navdeep
MMM tell me if I’m wrong, but what you want to do is to make a copy of a file each time it is opened, whatever the access? Do you want to make the copy before or after any read/write? If you want to backup before any read/write, simply filter all IRP_MJ_CREATE on the devices you’re interested in, and make a copy with Zw* at this time. You’ll have to be in PASSIVE_LEVEL, but AFAIK IRP_MJ_CREATE occurs at this IRQL (correct me if I’m wrong). The sfilter example in the IFS DDK is a good starting point. Just make sure that the creation request is not for a new file, otherwise you’re going to copy empty files. If you want to backup after the read/write, add the PFILE_OBJECT to a driver maintained structure at IRP_MJ_CREATE, monitor potential IRP_MJ_WRITE to this PFILE_OBJECT and flag it “dirty” if one occurs. At IRP_MJ_CLOSE, simply backup dirty files. One little trick for this latter exercice : because of the streams, you’ll have to monitor and add to your collection new PFILE_OBJECTs which have the same FCB than the one you’re monitoring. Hope it’s helpful.
Edouard
----- Original Message -----
From: “Navdeep”
To:
Sent: Wednesday, March 08, 2006 12:07 PM
Subject: Wirte file system filter drive
> Hi all,
>
> This is my first mail to this list. I am working on file backup tool.
> For this i need to take the backup of exclusively open files also.
> I search on google to take the backup of open file then i came to know that
> i will have to write the file system filter driver for this. Can any one
> help me out that what are the functions to be use to copy the open files
>
> I have tried zwCreateFile function but it’s not working.
>
> Regards
>
> Navdeep
>
>
>
>
Thanks Urban,
I really want to do it, I have some registry files and ntuser.dat file which
always open exclusively.I know all these filed ,
now my query is
Regards
Navdeep
----- Original Message -----
From: “Urban Purkat”
To: “Windows File Systems Devs Interest List”
Sent: Wednesday, March 08, 2006 3:01 PM
Subject: Re: [ntfsd] Wirte file system filter drive
> > MMM tell me if I’m wrong, but what you want to do is to make a copy of a
> > file each time it is opened, whatever the access? Do you want to make
> > the copy before or after any read/write?
>
> I think Navdeep wants to be able to back up the files that are
> currently opened exclusively.
>
> To achieve that you can detect such opens in IRP_MJ_CREATE and change
> the open options. Therefore another application will be able to open
> the file in parallel. But you have to be aware of consequences of
> changing the open options. I think you should then filter out (deny)
> all further opens (except for your backup tool) until the exclusively
> opened file is closed.
>
> But anyhow you will have problems the file is being written/read using
> memory mapped access.
>
> Regards,
> Urban
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
One question.
Why are you looking to do this in the kernel ?
If all you want to do is to be able to backup such files, then you
should explore VSS (Volume Shadow Copy Service) which works from XP
onwards. There are flags in the VSS APIs to allow you to create a
backup set for all the critical system files. Indeed, that’s how the
native Backup utility works when you tick the box asking for a backup
of the system state.
Mark.
At 10:05 AM 3/8/2006, Navdeep wrote:
Thanks Urban,
I really want to do it, I have some registry files and ntuser.dat file which
always open exclusively.I know all these filed ,
now my query is
- is still need to detect those files?
- How to change these files open option (any function)?
Regards
Navdeep
----- Original Message -----
From: “Urban Purkat”
>To: “Windows File Systems Devs Interest List”
>Sent: Wednesday, March 08, 2006 3:01 PM
>Subject: Re: [ntfsd] Wirte file system filter drive
>
>
> > > MMM tell me if I’m wrong, but what you want to do is to make a copy of a
> > > file each time it is opened, whatever the access? Do you want to make
> > > the copy before or after any read/write?
> >
> > I think Navdeep wants to be able to back up the files that are
> > currently opened exclusively.
> >
> > To achieve that you can detect such opens in IRP_MJ_CREATE and change
> > the open options. Therefore another application will be able to open
> > the file in parallel. But you have to be aware of consequences of
> > changing the open options. I think you should then filter out (deny)
> > all further opens (except for your backup tool) until the exclusively
> > opened file is closed.
> >
> > But anyhow you will have problems the file is being written/read using
> > memory mapped access.
> >
> > Regards,
> > Urban
> >
> >
> > —
> > Questions? First check the IFS FAQ at
>https://www.osronline.com/article.cfm?id=17
> >
> > You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
>—
>Questions? First check the IFS FAQ at
>https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: xxxxx@muttsnuts.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com
Navdeep wrote:
Thanks Urban,
I really want to do it, I have some registry files and ntuser.dat file which
always open exclusively.I know all these filed ,
The locking is handled by NTFS. You can’t override it in a filter
driver except by overriding the lock request in IRP_MJ_CREATE (which is
not recommended at all unless you’re really sure you know what you’re
doing and what the consequences are).
Tony
Volume Shadow Copy Service works only for win xP not win 2K
i am looking for windows 2K and XP both
regards
Navdeep
----- Original Message -----
From: “Mark S. Edwards”
To: “Windows File Systems Devs Interest List”
Sent: Wednesday, March 08, 2006 3:54 PM
Subject: Re: [ntfsd] Wirte file system filter drive
> One question.
>
> Why are you looking to do this in the kernel ?
>
> If all you want to do is to be able to backup such files, then you
> should explore VSS (Volume Shadow Copy Service) which works from XP
> onwards. There are flags in the VSS APIs to allow you to create a
> backup set for all the critical system files. Indeed, that’s how the
> native Backup utility works when you tick the box asking for a backup
> of the system state.
>
> Mark.
>
>
>
> At 10:05 AM 3/8/2006, Navdeep wrote:
> >Thanks Urban,
> >
> >I really want to do it, I have some registry files and ntuser.dat file
which
> >always open exclusively.I know all these filed ,
> >now my query is
> >
> >1. is still need to detect those files?
> >2. How to change these files open option (any function)?
> >
> >
> >Regards
> >
> >Navdeep
> >
> >
> >
> >----- Original Message -----
> >From: “Urban Purkat”
> >To: “Windows File Systems Devs Interest List”
> >Sent: Wednesday, March 08, 2006 3:01 PM
> >Subject: Re: [ntfsd] Wirte file system filter drive
> >
> >
> > > > MMM tell me if I’m wrong, but what you want to do is to make a copy
of a
> > > > file each time it is opened, whatever the access? Do you want to
make
> > > > the copy before or after any read/write?
> > >
> > > I think Navdeep wants to be able to back up the files that are
> > > currently opened exclusively.
> > >
> > > To achieve that you can detect such opens in IRP_MJ_CREATE and change
> > > the open options. Therefore another application will be able to open
> > > the file in parallel. But you have to be aware of consequences of
> > > changing the open options. I think you should then filter out (deny)
> > > all further opens (except for your backup tool) until the exclusively
> > > opened file is closed.
> > >
> > > But anyhow you will have problems the file is being written/read using
> > > memory mapped access.
> > >
> > > Regards,
> > > Urban
> > >
> > >
> > > —
> > > Questions? First check the IFS FAQ at
> >https://www.osronline.com/article.cfm?id=17
> > >
> > > You are currently subscribed to ntfsd as: unknown lmsubst tag
argument: ‘’
> > > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >
> >
> >—
> >Questions? First check the IFS FAQ at
> >https://www.osronline.com/article.cfm?id=17
> >
> >You are currently subscribed to ntfsd as: xxxxx@muttsnuts.com
> >To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@stellarinfo.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
Why do you want to override NTFS’s locking mechanism. As everyone has
mentioned, it is not recommended approach.
You can create a alternative path to backup locked files. Create a volume
similar to your original volume. And copy all files using this alternative
path.
IUknown
On 3/8/06, Navdeep wrote:
>
> Volume Shadow Copy Service works only for win xP not win 2K
>
> i am looking for windows 2K and XP both
>
> regards
> Navdeep
>
> ----- Original Message -----
> From: “Mark S. Edwards”
> To: “Windows File Systems Devs Interest List”
> Sent: Wednesday, March 08, 2006 3:54 PM
> Subject: Re: [ntfsd] Wirte file system filter drive
>
>
> > One question.
> >
> > Why are you looking to do this in the kernel ?
> >
> > If all you want to do is to be able to backup such files, then you
> > should explore VSS (Volume Shadow Copy Service) which works from XP
> > onwards. There are flags in the VSS APIs to allow you to create a
> > backup set for all the critical system files. Indeed, that’s how the
> > native Backup utility works when you tick the box asking for a backup
> > of the system state.
> >
> > Mark.
> >
> >
> >
> > At 10:05 AM 3/8/2006, Navdeep wrote:
> > >Thanks Urban,
> > >
> > >I really want to do it, I have some registry files and ntuser.dat file
> which
> > >always open exclusively.I know all these filed ,
> > >now my query is
> > >
> > >1. is still need to detect those files?
> > >2. How to change these files open option (any function)?
> > >
> > >
> > >Regards
> > >
> > >Navdeep
> > >
> > >
> > >
> > >----- Original Message -----
> > >From: “Urban Purkat”
> > >To: “Windows File Systems Devs Interest List”
> > >Sent: Wednesday, March 08, 2006 3:01 PM
> > >Subject: Re: [ntfsd] Wirte file system filter drive
> > >
> > >
> > > > > MMM tell me if I’m wrong, but what you want to do is to make a
> copy
> of a
> > > > > file each time it is opened, whatever the access? Do you want to
> make
> > > > > the copy before or after any read/write?
> > > >
> > > > I think Navdeep wants to be able to back up the files that are
> > > > currently opened exclusively.
> > > >
> > > > To achieve that you can detect such opens in IRP_MJ_CREATE and
> change
> > > > the open options. Therefore another application will be able to open
> > > > the file in parallel. But you have to be aware of consequences of
> > > > changing the open options. I think you should then filter out (deny)
> > > > all further opens (except for your backup tool) until the
> exclusively
> > > > opened file is closed.
> > > >
> > > > But anyhow you will have problems the file is being written/read
> using
> > > > memory mapped access.
> > > >
> > > > Regards,
> > > > Urban
> > > >
> > > >
> > > > —
> > > > Questions? First check the IFS FAQ at
> > >https://www.osronline.com/article.cfm?id=17
> > > >
> > > > You are currently subscribed to ntfsd as: unknown lmsubst tag
> argument: ‘’
> > > > To unsubscribe send a blank email to
> xxxxx@lists.osr.com
> > >
> > >
> > >
> > >—
> > >Questions? First check the IFS FAQ at
> > >https://www.osronline.com/article.cfm?id=17
> > >
> > >You are currently subscribed to ntfsd as: xxxxx@muttsnuts.com
> > >To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >
> >
> >
> > —
> > Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
> >
> > You are currently subscribed to ntfsd as: xxxxx@stellarinfo.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
–
------------
IUknown
My main motive is to copy the exclusively open files.
If there is any other way to do this then please tell me.
Can i copy these files just before these aare to open by the system.
If yes then how.
regards
NAvdeep
----- Original Message -----
From: I Unknown
To: Windows File Systems Devs Interest List
Sent: Wednesday, March 08, 2006 4:50 PM
Subject: Re: [ntfsd] Wirte file system filter drive
Why do you want to override NTFS’s locking mechanism. As everyone has mentioned, it is not recommended approach.
You can create a alternative path to backup locked files. Create a volume similar to your original volume. And copy all files using this alternative path.
IUknown
On 3/8/06, Navdeep wrote:
Volume Shadow Copy Service works only for win xP not win 2K
i am looking for windows 2K and XP both
regards
Navdeep
----- Original Message -----
From: “Mark S. Edwards”
To: “Windows File Systems Devs Interest List” < xxxxx@lists.osr.com>
Sent: Wednesday, March 08, 2006 3:54 PM
Subject: Re: [ntfsd] Wirte file system filter drive
> One question.
>
> Why are you looking to do this in the kernel ?
>
> If all you want to do is to be able to backup such files, then you
> should explore VSS (Volume Shadow Copy Service) which works from XP
> onwards. There are flags in the VSS APIs to allow you to create a
> backup set for all the critical system files. Indeed, that’s how the
> native Backup utility works when you tick the box asking for a backup
> of the system state.
>
> Mark.
>
>
>
> At 10:05 AM 3/8/2006, Navdeep wrote:
> >Thanks Urban,
> >
> >I really want to do it, I have some registry files and ntuser.dat file
which
> >always open exclusively.I know all these filed ,
> >now my query is
> >
> >1. is still need to detect those files?
> >2. How to change these files open option (any function)?
> >
> >
> >Regards
> >
> >Navdeep
> >
> >
> >
> >----- Original Message -----
> >From: “Urban Purkat”
> >To: “Windows File Systems Devs Interest List”
> >Sent: Wednesday, March 08, 2006 3:01 PM
> >Subject: Re: [ntfsd] Wirte file system filter drive
> >
> >
> > > > MMM tell me if I’m wrong, but what you want to do is to make a copy
of a
> > > > file each time it is opened, whatever the access? Do you want to
make
> > > > the copy before or after any read/write?
> > >
> > > I think Navdeep wants to be able to back up the files that are
> > > currently opened exclusively.
> > >
> > > To achieve that you can detect such opens in IRP_MJ_CREATE and change
> > > the open options. Therefore another application will be able to open
> > > the file in parallel. But you have to be aware of consequences of
> > > changing the open options. I think you should then filter out (deny)
> > > all further opens (except for your backup tool) until the exclusively
> > > opened file is closed.
> > >
> > > But anyhow you will have problems the file is being written/read using
> > > memory mapped access.
> > >
> > > Regards,
> > > Urban
> > >
> > >
> > > —
> > > Questions? First check the IFS FAQ at
> >https://www.osronline.com/article.cfm?id=17
> > >
> > > You are currently subscribed to ntfsd as: unknown lmsubst tag
argument: ‘’
> > > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >
> >
> >—
> >Questions? First check the IFS FAQ at
> >https://www.osronline.com/article.cfm?id=17
> >
> >You are currently subscribed to ntfsd as: xxxxx@muttsnuts.com
> >To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@stellarinfo.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@gmail.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
–
------------
IUknown — Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17 You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’ To unsubscribe send a blank email to xxxxx@lists.osr.com
Rather than FSFD, you can write a virtual volume driver. Create a virtual
volume for the original volume from which you want to backup open files.
Requests to virtual volume can be redirected to orginal volume. Since
virtual volume looks similar to original volume, fresh file system will
automatically mounted on this volume. Backup application now can read and
write files from this alternative path.
Problem in this approach is NTFS can not be mounted as read only in Win 2K.
And passing write requests to original volume might challenge the file
system consistency.
IUnknown
On 3/8/06, Navdeep wrote:
>
>
> My main motive is to copy the exclusively open files.
> If there is any other way to do this then please tell me.
>
> Can i copy these files just before these aare to open by the system.
> If yes then how.
>
> regards
> NAvdeep
>
> ----- Original Message -----
> From: I Unknown
> To: Windows File Systems Devs Interest List
> Sent: Wednesday, March 08, 2006 4:50 PM
> Subject: Re: [ntfsd] Wirte file system filter drive
>
>
> Why do you want to override NTFS’s locking mechanism. As everyone has
> mentioned, it is not recommended approach.
> You can create a alternative path to backup locked files. Create a volume
> similar to your original volume. And copy all files using this alternative
> path.
>
> ------------
> IUknown
>
>
> On 3/8/06, Navdeep wrote:
> >
> > Volume Shadow Copy Service works only for win xP not win 2K
> >
> > i am looking for windows 2K and XP both
> >
> > regards
> > Navdeep
> >
> > ----- Original Message -----
> > From: “Mark S. Edwards”
> > To: “Windows File Systems Devs Interest List” < xxxxx@lists.osr.com>
> > Sent: Wednesday, March 08, 2006 3:54 PM
> > Subject: Re: [ntfsd] Wirte file system filter drive
> >
> >
> > > One question.
> > >
> > > Why are you looking to do this in the kernel ?
> > >
> > > If all you want to do is to be able to backup such files, then you
> > > should explore VSS (Volume Shadow Copy Service) which works from XP
> > > onwards. There are flags in the VSS APIs to allow you to create a
> > > backup set for all the critical system files. Indeed, that’s how the
> > > native Backup utility works when you tick the box asking for a backup
> > > of the system state.
> > >
> > > Mark.
> > >
> > >
> > >
> > > At 10:05 AM 3/8/2006, Navdeep wrote:
> > > >Thanks Urban,
> > > >
> > > >I really want to do it, I have some registry files and ntuser.datfile
> > which
> > > >always open exclusively.I know all these filed ,
> > > >now my query is
> > > >
> > > >1. is still need to detect those files?
> > > >2. How to change these files open option (any function)?
> > > >
> > > >
> > > >Regards
> > > >
> > > >Navdeep
> > > >
> > > >
> > > >
> > > >----- Original Message -----
> > > >From: “Urban Purkat”
> > > >To: “Windows File Systems Devs Interest List”
> > > >Sent: Wednesday, March 08, 2006 3:01 PM
> > > >Subject: Re: [ntfsd] Wirte file system filter drive
> > > >
> > > >
> > > > > > MMM tell me if I’m wrong, but what you want to do is to make a
> > copy
> > of a
> > > > > > file each time it is opened, whatever the access? Do you want to
> > make
> > > > > > the copy before or after any read/write?
> > > > >
> > > > > I think Navdeep wants to be able to back up the files that are
> > > > > currently opened exclusively.
> > > > >
> > > > > To achieve that you can detect such opens in IRP_MJ_CREATE and
> > change
> > > > > the open options. Therefore another application will be able to
> > open
> > > > > the file in parallel. But you have to be aware of consequences of
> > > > > changing the open options. I think you should then filter out
> > (deny)
> > > > > all further opens (except for your backup tool) until the
> > exclusively
> > > > > opened file is closed.
> > > > >
> > > > > But anyhow you will have problems the file is being written/read
> > using
> > > > > memory mapped access.
> > > > >
> > > > > Regards,
> > > > > Urban
> > > > >
> > > > >
> > > > > —
> > > > > Questions? First check the IFS FAQ at
> > > >https://www.osronline.com/article.cfm?id=17
> > > > >
> > > > > You are currently subscribed to ntfsd as: unknown lmsubst tag
> > argument: ‘’
> > > > > To unsubscribe send a blank email to
> > xxxxx@lists.osr.com
> > > >
> > > >
> > > >
> > > >—
> > > >Questions? First check the IFS FAQ at
> > > >https://www.osronline.com/article.cfm?id=17
> > > >
> > > >You are currently subscribed to ntfsd as: xxxxx@muttsnuts.com
> > > >To unsubscribe send a blank email to xxxxx@lists.osr.com
> > >
> > >
> > >
> > >
> > > —
> > > Questions? First check the IFS FAQ at
> > https://www.osronline.com/article.cfm?id=17
> > >
> > > You are currently subscribed to ntfsd as: xxxxx@stellarinfo.com
> > > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >
> >
> > —
> > Questions? First check the IFS FAQ at
> > https://www.osronline.com/article.cfm?id=17
> >
> > You are currently subscribed to ntfsd as: xxxxx@gmail.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
>
>
>
> –
> ------------
> IUknown — Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17 You are currently subscribed
> to ntfsd as: unknown lmsubst tag argument: ‘’ To unsubscribe send a blank
> email to xxxxx@lists.osr.com
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
>
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
–
------------
IUknown
> Volume Shadow Copy Service works only for win xP not win 2K
i am looking for windows 2K and XP both
Then license some snapshot engine which can work on w2k. Snapshotting is the
normal way of doing what you need.
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
This can be done without a filter, it takes some work and for Windows 2000
use of some undocumented routines. I have written a driver fpr a customer
that reads the data even if the file is open exclusively or if byte-range
locking is applied.
–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply
“Navdeep” wrote in message news:xxxxx@ntfsd…
> Hi all,
>
> This is my first mail to this list. I am working on file backup tool.
> For this i need to take the backup of exclusively open files also.
> I search on google to take the backup of open file then i came to know
> that
> i will have to write the file system filter driver for this. Can any one
> help me out that what are the functions to be use to copy the open files
>
> I have tried zwCreateFile function but it’s not working.
>
> Regards
>
> Navdeep
>
>
>
>
>
>
> > Volume Shadow Copy Service works only for win xP not win 2K
>
> i am looking for windows 2K and XP bothThen license some snapshot engine which can work on w2k. Snapshotting is the
normal way of doing what you need.
I use StorageCraft VSnap on W2k and VSS on higher Win versions.
Regards,
Urban
HI,
But StorageCraft VSnap is itself a GUI software.
I am do this for my backup s/w. So i just can look for any driver, lib or
dll . to do this
regards
Navdeep
----- Original Message -----
From: “Urban Purkat”
To: “Windows File Systems Devs Interest List”
Sent: Thursday, March 09, 2006 12:38 PM
Subject: Re: [ntfsd] Wirte file system filter drive
> > > Volume Shadow Copy Service works only for win xP not win 2K
> > >
> > > i am looking for windows 2K and XP both
> >
> > Then license some snapshot engine which can work on w2k. Snapshotting is
the
> > normal way of doing what you need.
>
> I use StorageCraft VSnap on W2k and VSS on higher Win versions.
>
> Regards,
> Urban
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
> But StorageCraft VSnap is itself a GUI software.
I am do this for my backup s/w. So i just can look for any driver, lib or
dll . to do this
Not true. You can create a snapshot at least with python.
Regards,
Urban
Hi Urban
I am sorry to ask, I dont know anything about python, can you tell me in
detail .
how can i use this with python.If you can help me using bunch of code then i
ll be thankful to you
regards
Navdeep
----- Original Message -----
From: “Urban Purkat”
To: “Windows File Systems Devs Interest List”
Sent: Thursday, March 09, 2006 5:58 PM
Subject: Re: [ntfsd] Wirte file system filter drive
> > But StorageCraft VSnap is itself a GUI software.
> > I am do this for my backup s/w. So i just can look for any driver, lib
or
> > dll . to do this
>
> Not true. You can create a snapshot at least with python.
>
> Regards,
> Urban
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
navdeep,
Don’t use python. That is a cross platform scripting language. If your
developing a windows driver, keep everything in windows compiled
languages like c, c++. Use VB or Delphi before going to python. Python
is essentially a scripting language and requires it’s own runtime
framework which is almost 25 meg of extra crap your application will
have to install before it can be used.
There is nothing that can be done in python that C, C++, VB, DELPHI
can’t do…
m.
Navdeep wrote:
Hi Urban
I am sorry to ask, I dont know anything about python, can you tell me in
detail .
how can i use this with python.If you can help me using bunch of code then i
ll be thankful to youregards
Navdeep----- Original Message -----
From: “Urban Purkat”
>To: “Windows File Systems Devs Interest List”
>Sent: Thursday, March 09, 2006 5:58 PM
>Subject: Re: [ntfsd] Wirte file system filter drive
>
>
>
>
>>>But StorageCraft VSnap is itself a GUI software.
>>>I am do this for my backup s/w. So i just can look for any driver, lib
>>>
>>>
>or
>
>
>>>dll . to do this
>>>
>>>
>>Not true. You can create a snapshot at least with python.
>>
>>Regards,
>>Urban
>>
>>
>>—
>>Questions? First check the IFS FAQ at
>>
>>
>https://www.osronline.com/article.cfm?id=17
>
>
>>You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>>
>
>
>
>—
>Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: xxxxx@comcast.net
>To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
Hi I Unknown,
Create a volume similar to your original volume. And copy all files using this alternative path
How is it possible , con you give me brief idea about it.
Regards
Navdeep
----- Original Message -----
From: I Unknown
To: Windows File Systems Devs Interest List
Sent: Wednesday, March 08, 2006 4:50 PM
Subject: Re: [ntfsd] Wirte file system filter drive
Why do you want to override NTFS’s locking mechanism. As everyone has mentioned, it is not recommended approach.
You can create a alternative path to backup locked files. Create a volume similar to your original volume. And copy all files using this alternative path.
IUknown
On 3/8/06, Navdeep wrote:
Volume Shadow Copy Service works only for win xP not win 2K
i am looking for windows 2K and XP both
regards
Navdeep
----- Original Message -----
From: “Mark S. Edwards”
To: “Windows File Systems Devs Interest List” < xxxxx@lists.osr.com>
Sent: Wednesday, March 08, 2006 3:54 PM
Subject: Re: [ntfsd] Wirte file system filter drive
> One question.
>
> Why are you looking to do this in the kernel ?
>
> If all you want to do is to be able to backup such files, then you
> should explore VSS (Volume Shadow Copy Service) which works from XP
> onwards. There are flags in the VSS APIs to allow you to create a
> backup set for all the critical system files. Indeed, that’s how the
> native Backup utility works when you tick the box asking for a backup
> of the system state.
>
> Mark.
>
>
>
> At 10:05 AM 3/8/2006, Navdeep wrote:
> >Thanks Urban,
> >
> >I really want to do it, I have some registry files and ntuser.dat file
which
> >always open exclusively.I know all these filed ,
> >now my query is
> >
> >1. is still need to detect those files?
> >2. How to change these files open option (any function)?
> >
> >
> >Regards
> >
> >Navdeep
> >
> >
> >
> >----- Original Message -----
> >From: “Urban Purkat”
> >To: “Windows File Systems Devs Interest List”
> >Sent: Wednesday, March 08, 2006 3:01 PM
> >Subject: Re: [ntfsd] Wirte file system filter drive
> >
> >
> > > > MMM tell me if I’m wrong, but what you want to do is to make a copy
of a
> > > > file each time it is opened, whatever the access? Do you want to
make
> > > > the copy before or after any read/write?
> > >
> > > I think Navdeep wants to be able to back up the files that are
> > > currently opened exclusively.
> > >
> > > To achieve that you can detect such opens in IRP_MJ_CREATE and change
> > > the open options. Therefore another application will be able to open
> > > the file in parallel. But you have to be aware of consequences of
> > > changing the open options. I think you should then filter out (deny)
> > > all further opens (except for your backup tool) until the exclusively
> > > opened file is closed.
> > >
> > > But anyhow you will have problems the file is being written/read using
> > > memory mapped access.
> > >
> > > Regards,
> > > Urban
> > >
> > >
> > > —
> > > Questions? First check the IFS FAQ at
> >https://www.osronline.com/article.cfm?id=17
> > >
> > > You are currently subscribed to ntfsd as: unknown lmsubst tag
argument: ‘’
> > > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >
> >
> >—
> >Questions? First check the IFS FAQ at
> >https://www.osronline.com/article.cfm?id=17
> >
> >You are currently subscribed to ntfsd as: xxxxx@muttsnuts.com
> >To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@stellarinfo.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@gmail.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
–
------------
IUknown — Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17 You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’ To unsubscribe send a blank email to xxxxx@lists.osr.com
Hi IUnknown,
I tried to do somthing on your approach but could not get any clue ,
can u tell me how to Create a volume similar to my original volume. And use this alternative path.
regards
Navdeep
----- Original Message -----
From: I Unknown
To: Windows File Systems Devs Interest List
Sent: Wednesday, March 08, 2006 4:50 PM
Subject: Re: [ntfsd] Wirte file system filter drive
Why do you want to override NTFS’s locking mechanism. As everyone has mentioned, it is not recommended approach.
You can create a alternative path to backup locked files. Create a volume similar to your original volume. And copy all files using this alternative path.
IUknown
On 3/8/06, Navdeep wrote:
Volume Shadow Copy Service works only for win xP not win 2K
i am looking for windows 2K and XP both
regards
Navdeep
----- Original Message -----
From: “Mark S. Edwards”
To: “Windows File Systems Devs Interest List” < xxxxx@lists.osr.com>
Sent: Wednesday, March 08, 2006 3:54 PM
Subject: Re: [ntfsd] Wirte file system filter drive
> One question.
>
> Why are you looking to do this in the kernel ?
>
> If all you want to do is to be able to backup such files, then you
> should explore VSS (Volume Shadow Copy Service) which works from XP
> onwards. There are flags in the VSS APIs to allow you to create a
> backup set for all the critical system files. Indeed, that’s how the
> native Backup utility works when you tick the box asking for a backup
> of the system state.
>
> Mark.
>
>
>
> At 10:05 AM 3/8/2006, Navdeep wrote:
> >Thanks Urban,
> >
> >I really want to do it, I have some registry files and ntuser.dat file
which
> >always open exclusively.I know all these filed ,
> >now my query is
> >
> >1. is still need to detect those files?
> >2. How to change these files open option (any function)?
> >
> >
> >Regards
> >
> >Navdeep
> >
> >
> >
> >----- Original Message -----
> >From: “Urban Purkat”
> >To: “Windows File Systems Devs Interest List”
> >Sent: Wednesday, March 08, 2006 3:01 PM
> >Subject: Re: [ntfsd] Wirte file system filter drive
> >
> >
> > > > MMM tell me if I’m wrong, but what you want to do is to make a copy
of a
> > > > file each time it is opened, whatever the access? Do you want to
make
> > > > the copy before or after any read/write?
> > >
> > > I think Navdeep wants to be able to back up the files that are
> > > currently opened exclusively.
> > >
> > > To achieve that you can detect such opens in IRP_MJ_CREATE and change
> > > the open options. Therefore another application will be able to open
> > > the file in parallel. But you have to be aware of consequences of
> > > changing the open options. I think you should then filter out (deny)
> > > all further opens (except for your backup tool) until the exclusively
> > > opened file is closed.
> > >
> > > But anyhow you will have problems the file is being written/read using
> > > memory mapped access.
> > >
> > > Regards,
> > > Urban
> > >
> > >
> > > —
> > > Questions? First check the IFS FAQ at
> >https://www.osronline.com/article.cfm?id=17
> > >
> > > You are currently subscribed to ntfsd as: unknown lmsubst tag
argument: ‘’
> > > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >
> >
> >—
> >Questions? First check the IFS FAQ at
> >https://www.osronline.com/article.cfm?id=17
> >
> >You are currently subscribed to ntfsd as: xxxxx@muttsnuts.com
> >To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@stellarinfo.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@gmail.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
–
------------
IUknown — Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17 You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’ To unsubscribe send a blank email to xxxxx@lists.osr.com