ZwCreateFile changes volume to RAW

I’m using ZwCreateFile() to open a volume to get information with the ZwQueryVolumeInformationFile(). But when I used the ZwCreateFile() with this parameters:
status = ZwCreateFile(&deviceHand,
FILE_READ_ATTRIBUTES | FILE_WRITE_ATTRIBUTES,
&objAttribDev,
&ioStatusBlock,
0,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ | FILE_SHARE_WRITE,
FILE_OPEN,
FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,
0,
0);

The volume (NTFS) change to RAW, and I can’t get the informations.
And when I used with these parameters
status = ZwCreateFile(&deviceHand,
FILE_READ_ATTRIBUTES,
&objAttribDev,
&ioStatusBlock,
0,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ ,
FILE_OPEN,
FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,
0,
0);
The volume don’t change, but the ZwQueryVolumeInformationFile return ERROR

You did not say what version of Windows, but I am guessing you are
hitting this with Vista or later. You cannot open a mounted volume for
writing in Windows starting with Vista, so you get the error. You also
can’t open the volume the way you are except for RAW since you are below
the filesystem. You need to open a file or a directory on the file
system to use ZwQueryVolumeInformationFile().

Don Burn (MVP, Windows DKD)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

xxxxx@gmail.com” wrote in message
news:xxxxx@ntdev:

> I’m using ZwCreateFile() to open a volume to get information with the ZwQueryVolumeInformationFile(). But when I used the ZwCreateFile() with this parameters:
> status = ZwCreateFile(&deviceHand,
> FILE_READ_ATTRIBUTES | FILE_WRITE_ATTRIBUTES,
> &objAttribDev,
> &ioStatusBlock,
> 0,
> FILE_ATTRIBUTE_NORMAL,
> FILE_SHARE_READ | FILE_SHARE_WRITE,
> FILE_OPEN,
> FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,
> 0,
> 0);
>
> The volume (NTFS) change to RAW, and I can’t get the informations.
> And when I used with these parameters
> status = ZwCreateFile(&deviceHand,
> FILE_READ_ATTRIBUTES,
> &objAttribDev,
> &ioStatusBlock,
> 0,
> FILE_ATTRIBUTE_NORMAL,
> FILE_SHARE_READ ,
> FILE_OPEN,
> FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,
> 0,
> 0);
> The volume don’t change, but the ZwQueryVolumeInformationFile return ERROR

The driver I’m developing is a storage filter to get some informations about
the volumes on boot. If I open (ZwCreateFile) a file in the C:
(\Device\HarddiskVolume1) everything works fine, but if I tried to open a
file in the D: (\Device\HarddiskVolume2) the ZwCreateFIle returns ERROR.
Anyone have any idea what it’s happeing?

Thiago Fabre
UNESP / Bauru - Brasil
(14) 91096114

On Fri, Feb 25, 2011 at 2:18 PM, Don Burn wrote:

> You did not say what version of Windows, but I am guessing you are hitting
> this with Vista or later. You cannot open a mounted volume for writing in
> Windows starting with Vista, so you get the error. You also can’t open the
> volume the way you are except for RAW since you are below the filesystem.
> You need to open a file or a directory on the file system to use
> ZwQueryVolumeInformationFile().
>
>
> Don Burn (MVP, Windows DKD)
> Windows Filesystem and Driver Consulting
> Website: http://www.windrvr.com
> Blog: http://msmvps.com/blogs/WinDrvr
>
>
>
>
> “xxxxx@gmail.com” wrote in message
> news:xxxxx@ntdev:
>
>
> I’m using ZwCreateFile() to open a volume to get information with the
>> ZwQueryVolumeInformationFile(). But when I used the ZwCreateFile() with
>> this parameters:
>> status = ZwCreateFile(&deviceHand,
>> FILE_READ_ATTRIBUTES | FILE_WRITE_ATTRIBUTES,
>> &objAttribDev,
>> &ioStatusBlock,
>> 0,
>> FILE_ATTRIBUTE_NORMAL,
>> FILE_SHARE_READ | FILE_SHARE_WRITE,
>> FILE_OPEN,
>> FILE_SYNCHRONOUS_IO_NONALERT |
>> FILE_NON_DIRECTORY_FILE,
>> 0,
>> 0);
>>
>> The volume (NTFS) change to RAW, and I can’t get the informations.
>> And when I used with these parameters
>> status = ZwCreateFile(&deviceHand,
>> FILE_READ_ATTRIBUTES,
>> &objAttribDev,
>> &ioStatusBlock,
>> 0,
>> FILE_ATTRIBUTE_NORMAL,
>> FILE_SHARE_READ ,
>> FILE_OPEN,
>> FILE_SYNCHRONOUS_IO_NONALERT |
>> FILE_NON_DIRECTORY_FILE,
>> 0,
>> 0);
>> The volume don’t change, but the ZwQueryVolumeInformationFile return ERROR
>>
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

When in the boot process? For boot drivers only the boot volume can be
trusted to be there.

Don Burn (MVP, Windows DKD)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

“Thiago Fabre” wrote in message
news:xxxxx@ntdev:

> The driver I’m developing is a storage filter to get some informations about
> the volumes on boot. If I open (ZwCreateFile) a file in the C:
> (\Device\HarddiskVolume1) everything works fine, but if I tried to open a
> file in the D: (\Device\HarddiskVolume2) the ZwCreateFIle returns ERROR.
> Anyone have any idea what it’s happeing?
>
>
>
> Thiago Fabre
> UNESP / Bauru - Brasil
> (14) 91096114
>
>
> On Fri, Feb 25, 2011 at 2:18 PM, Don Burn wrote:
>
> > You did not say what version of Windows, but I am guessing you are hitting
> > this with Vista or later. You cannot open a mounted volume for writing in
> > Windows starting with Vista, so you get the error. You also can’t open the
> > volume the way you are except for RAW since you are below the filesystem.
> > You need to open a file or a directory on the file system to use
> > ZwQueryVolumeInformationFile().
> >
> >
> > Don Burn (MVP, Windows DKD)
> > Windows Filesystem and Driver Consulting
> > Website: http://www.windrvr.com
> > Blog: http://msmvps.com/blogs/WinDrvr
> >
> >
> >
> >
> > “xxxxx@gmail.com” wrote in message
> > news:xxxxx@ntdev:
> >
> >
> > I’m using ZwCreateFile() to open a volume to get information with the
> >> ZwQueryVolumeInformationFile(). But when I used the ZwCreateFile() with
> >> this parameters:
> >> status = ZwCreateFile(&deviceHand,
> >> FILE_READ_ATTRIBUTES | FILE_WRITE_ATTRIBUTES,
> >> &objAttribDev,
> >> &ioStatusBlock,
> >> 0,
> >> FILE_ATTRIBUTE_NORMAL,
> >> FILE_SHARE_READ | FILE_SHARE_WRITE,
> >> FILE_OPEN,
> >> FILE_SYNCHRONOUS_IO_NONALERT |
> >> FILE_NON_DIRECTORY_FILE,
> >> 0,
> >> 0);
> >>
> >> The volume (NTFS) change to RAW, and I can’t get the informations.
> >> And when I used with these parameters
> >> status = ZwCreateFile(&deviceHand,
> >> FILE_READ_ATTRIBUTES,
> >> &objAttribDev,
> >> &ioStatusBlock,
> >> 0,
> >> FILE_ATTRIBUTE_NORMAL,
> >> FILE_SHARE_READ ,
> >> FILE_OPEN,
> >> FILE_SYNCHRONOUS_IO_NONALERT |
> >> FILE_NON_DIRECTORY_FILE,
> >> 0,
> >> 0);
> >> The volume don’t change, but the ZwQueryVolumeInformationFile return ERROR
> >>
> >
> >
> > —
> > NTDEV is sponsored by OSR
> >
> > For our schedule of WDF, WDM, debugging and other seminars visit:
> > http://www.osr.com/seminars
> >
> > To unsubscribe, visit the List Server section of OSR Online at
> > http://www.osronline.com/page.cfm?name=ListServer
> >

Is there any way to find out when another volume is ready? Because i need to
create a file in this volume

s,
Thiago Fabre
NNESP / Bauru
(14) 91096114

On Fri, Feb 25, 2011 at 4:14 PM, Don Burn wrote:

> When in the boot process? For boot drivers only the boot volume can be
> trusted to be there.
>
>
>
> Don Burn (MVP, Windows DKD)
> Windows Filesystem and Driver Consulting
> Website: http://www.windrvr.com
> Blog: http://msmvps.com/blogs/WinDrvr
>
>
>
>
> “Thiago Fabre” wrote in message news:xxxxx@ntdev
> :
>
>
> The driver I’m developing is a storage filter to get some informations
>> about
>> the volumes on boot. If I open (ZwCreateFile) a file in the C:
>> (\Device\HarddiskVolume1) everything works fine, but if I tried to open a
>> file in the D: (\Device\HarddiskVolume2) the ZwCreateFIle returns ERROR.
>> Anyone have any idea what it’s happeing?
>>
>>
>>
>> Thiago Fabre
>> UNESP / Bauru - Brasil
>> (14) 91096114
>>
>>
>> On Fri, Feb 25, 2011 at 2:18 PM, Don Burn wrote:
>>
>> > You did not say what version of Windows, but I am guessing you are
>> hitting
>> > this with Vista or later. You cannot open a mounted volume for writing
>> in
>> > Windows starting with Vista, so you get the error. You also can’t open
>> the
>> > volume the way you are except for RAW since you are below the
>> filesystem.
>> > You need to open a file or a directory on the file system to use
>> > ZwQueryVolumeInformationFile().
>> >
>> >
>> > Don Burn (MVP, Windows DKD)
>> > Windows Filesystem and Driver Consulting
>> > Website: http://www.windrvr.com
>> > Blog: http://msmvps.com/blogs/WinDrvr
>> >
>> >
>> >
>> >
>> > “xxxxx@gmail.com” wrote in message
>> > news:xxxxx@ntdev:
>> >
>> >
>> > I’m using ZwCreateFile() to open a volume to get information with the
>> >> ZwQueryVolumeInformationFile(). But when I used the ZwCreateFile()
>> with
>> >> this parameters:
>> >> status = ZwCreateFile(&deviceHand,
>> >> FILE_READ_ATTRIBUTES | FILE_WRITE_ATTRIBUTES,
>> >> &objAttribDev,
>> >> &ioStatusBlock,
>> >> 0,
>> >> FILE_ATTRIBUTE_NORMAL,
>> >> FILE_SHARE_READ | FILE_SHARE_WRITE,
>> >> FILE_OPEN,
>> >> FILE_SYNCHRONOUS_IO_NONALERT |
>> >> FILE_NON_DIRECTORY_FILE,
>> >> 0,
>> >> 0);
>> >>
>> >> The volume (NTFS) change to RAW, and I can’t get the informations.
>> >> And when I used with these parameters
>> >> status = ZwCreateFile(&deviceHand,
>> >> FILE_READ_ATTRIBUTES,
>> >> &objAttribDev,
>> >> &ioStatusBlock,
>> >> 0,
>> >> FILE_ATTRIBUTE_NORMAL,
>> >> FILE_SHARE_READ ,
>> >> FILE_OPEN,
>> >> FILE_SYNCHRONOUS_IO_NONALERT |
>> >> FILE_NON_DIRECTORY_FILE,
>> >> 0,
>> >> 0);
>> >> The volume don’t change, but the ZwQueryVolumeInformationFile return
>> ERROR
>> >>
>> >
>> >
>> > —
>> > NTDEV is sponsored by OSR
>> >
>> > For our schedule of WDF, WDM, debugging and other seminars visit:
>> > http://www.osr.com/seminars
>> >
>> > To unsubscribe, visit the List Server section of OSR Online at
>> > http://www.osronline.com/page.cfm?name=ListServer
>> >
>>
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

> hitting this with Vista or later. You cannot open a mounted volume for

writing in Windows starting with Vista, so you get the error.

You can. CHKDSK /F does exactly this.


Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com