Driver Problems? Questions? Issues?
Put OSR's experience to work for you! Contact us for assistance with:
  • Creating the right design for your requirements
  • Reviewing your existing driver code
  • Analyzing driver reliability/performance issues
  • Custom training mixed with consulting and focused directly on your specific areas of interest/concern.
Check us out. OSR, the Windows driver experts.

On-Access, Transparent, Per-File Data Encryption:

OSR's File Encryption Solution Framework (FESF) provides all the infrastructure you need to build a transparent file encryption product REALLY FAST.

Super flexible policy determination and customization, all done in user-mode. Extensive starter/sample code provided.

Proven, robust, flexible. In use in multiple commercial products.

Currently available on Windows. FESF for Linux will ship in 2018.

For more info: https://www.osr.com/fesf

Go Back   OSR Online Lists > ntfsd
Welcome, Guest
You must login to post to this list
  Message 1 of 3  
13 Jul 17 06:58
ramakrishnan s
xxxxxx@gmail.com
Join Date: 21 Oct 2016
Posts To This List: 17
Re: Minifilter not intercepting IRP_MJ_WRITE, when a file is copied

Hi, The condition you mentioned "if ( NULL == FileObject->SectionObjectPointer || NULL == FileObject->SectionObjectPointer->DataSection )" works fine for intercepting IRP_MJ_WRITE. But it is is not working properly for intercepting IRP_MJ_READ. When a .jpg file is read by a photoviewer.dll , some IRP_MJ_READ s are missed by the mini filter. Please let me know a method to identify whether a IRP_MJ_READ is going to disk or cache, for a network volume. Thanks, S Ramakrishnan On Sun, Nov 20, 2016 at 11:46 AM, <xxxxx@hotmail.com> wrote: > <QUOTE> > If a notepad file is created inside the network volume, some data is typed > and saved then the filter driver gets IRP_MJ_WRITE. > But when a file is copied to the network volume, the filter driver does not > get IRP_MJ_WRITE. > </QUOTE> > > Notepad uses a memory mapped file, this is analogues to file being cached. > When Memory Manager flushes dirty pages the filter receives paging IO. > <...excess quoted lines suppressed...> --
  Message 2 of 3  
13 Jul 17 10:56
Slava Imameev
xxxxxx@hotmail.com
Join Date: 13 Sep 2013
Posts To This List: 264
Re: Minifilter not intercepting IRP_MJ_WRITE, when a file is copied

<QUOTE> Please let me know a method to identify whether a IRP_MJ_READ is going to disk or cache, for a network volume. </QUOTE> I do not remember the exact conditions this particular advice was given and I am reading the list through the online version that jettisons the history. You can only be sure that paging IO will not end up in the cache. All other cases are implementation dependent. With a good probability non-paging read is processed through the cache. You can find a heuristic for a particular network FSD for some IO cases.
  Message 3 of 3  
14 Jul 17 00:48
ramakrishnan s
xxxxxx@gmail.com
Join Date: 21 Oct 2016
Posts To This List: 17
Re: Minifilter not intercepting IRP_MJ_WRITE, when a file is copied

I already tried this. But non paging read is going to disk in case of word document and excel. On Thu, Jul 13, 2017 at 8:25 PM, xxxxx@hotmail.com <xxxxx@lists.osr.com> wrote: > <QUOTE> > Please let me know a method to identify whether a IRP_MJ_READ is going to > disk or cache, for a network volume. > </QUOTE> > > I do not remember the exact conditions this particular advice was given > and I am reading the list through the online version that jettisons the > history. > > You can only be sure that paging IO will not end up in the cache. All <...excess quoted lines suppressed...> --
Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You must login to OSR Online AND be a member of the ntfsd list to be able to post.

All times are GMT -5. The time now is 08:12.


Copyright ©2015, OSR Open Systems Resources, Inc.
Based on vBulletin Copyright ©2000 - 2005, Jelsoft Enterprises Ltd.
Modified under license