Driver Problems? Questions? Issues?
Put OSR's experience to work for you! Contact us for assistance with:
  • Creating the right design for your requirements
  • Reviewing your existing driver code
  • Analyzing driver reliability/performance issues
  • Custom training mixed with consulting and focused directly on your specific areas of interest/concern.
Check us out. OSR, the Windows driver experts.

OSR Seminars


Go Back   OSR Online Lists > ntdev
Welcome, Guest
You must login to post to this list
  Message 1 of 2  
03 Aug 18 07:07
vidhya
xxxxxx@yahoo.co.in
Join Date: 01 Apr 2008
Posts To This List: 86
Can Read and Write IRPs come before IOCTL_VOLUME_ONLINE to a volume

I need to start tracking the write IRPs happening on the volume. To do that I thought of starting my tracking once I receive IOCTL_VOLUME_ONLINE to that volume. Can Read and Write IRPs come before IOCTL_VOLUME_ONLINE to a volume. or should I rely on IRP_MN_MOUNT_VOLUME. Basically should I start tracking once I receive IRP_MN_MOUNT_VOLUME. which one is more reliable. I remember I saw somewhere where people have mentioned that they have seen Read IRPs before IOCTL_VOLUME_ONLINE. Thanks in Advance
  Message 2 of 2  
03 Aug 18 12:32
Jamey Kirby
xxxxxx@gmail.com
Join Date: 31 Dec 2014
Posts To This List: 301
Can Read and Write IRPs come before IOCTL_VOLUME_ONLINE to a volume

You do not need to filter ONLINE, and you surely do not need to filter any sort of MOUNT IRPS in the file system. You can do everything you need in the volume filter. Your tracking should start when you receive the first write to the volume. On Fri, Aug 3, 2018 at 7:07 AM xxxxx@yahoo.co.in < xxxxx@lists.osr.com> wrote: > I need to start tracking the write IRPs happening on the volume. To do > that I thought of starting my tracking once I receive IOCTL_VOLUME_ONLINE > to that volume. > Can Read and Write IRPs come before IOCTL_VOLUME_ONLINE to a volume. > or should I rely on IRP_MN_MOUNT_VOLUME. > Basically should I start tracking once I receive IRP_MN_MOUNT_VOLUME. > which one is more reliable. > > I remember I saw somewhere where people have mentioned that they have seen > Read IRPs before IOCTL_VOLUME_ONLINE. <...excess quoted lines suppressed...> -- Jamey Kirby Disrupting the establishment since 1964 *This is a personal email account and as such, emails are not subject to archiving. Nothing else really matters.* --
Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You must login to OSR Online AND be a member of the ntdev list to be able to post.

All times are GMT -5. The time now is 18:46.


Copyright ©2015, OSR Open Systems Resources, Inc.
Based on vBulletin Copyright ©2000 - 2005, Jelsoft Enterprises Ltd.
Modified under license