Writing to the locked file range

NTFSD
1

Hi all!

I have the following issue with the FS encryption filter driver:

When starting encryption, the driver encrypts all the files in place: reads
buffer, encrypts it, and writes to the file (read/write is non-cached and
synchronized with the other paging IOs).

When the driver tries to encrypt in place the outlook pst file, it receives
STATUS_FILE_LOCK_CONFLICT error.

I can read and write the pst file by using
ZwCreateSection/ZwMapViewOfSection as described

in NTFSD FAQ, but it modifies the share date, which is used by outlook too.

Is there any way to write to range locked file bypassing the cache?

Thanks,

Dani

2

Welcome to the wonderful world of filters.

Paging I/O bypasses byte range locks. If you use FltWriteFile you can specify that this should be sent as a paging I/O.

There’s a separate question of how you are going to handle failures in this model. I’d be REALLY unhappy if you screwed up my mail files, and such files are often large. If something goes wrong, you really need to have a solid story on how you will recover from the failure.

Best of luck.

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.