[Minifilter driver]volume has mounted on mount path or has driveletter.

NTFSD
1

I am writing a minifilter driver.
Whenever a file is opened then it comes to my IRP_MJ_CREATE then I use

IoVolumeDeviceToDosName() to determine whether the request comes from a mount path or it has drive letter.

Suppose I have mounted a volume on a folder say C:\testpath and I have not assigned any driveletter to it.
then IoVolumeDeviceToDosName API will return C:\testpath

If I have mounted a volume with a drive letter say D:
then IoVolumeDeviceToDosName API will return D:

So If a volume has a mount path then I do not update certain things.

Is there any better way to get to know whether a volume has mount path or not?

2

This is one approach. But you need to understand that there could be
multiple drive letters and mount paths for a single volume and they can
all change from user to user.

Pete

On 7/31/2014 7:53 AM, xxxxx@gmail.com wrote:

I am writing a minifilter driver.
Whenever a file is opened then it comes to my IRP_MJ_CREATE then I use

IoVolumeDeviceToDosName() to determine whether the request comes from a mount path or it has drive letter.

Suppose I have mounted a volume on a folder say C:\testpath and I have not assigned any driveletter to it.
then IoVolumeDeviceToDosName API will return C:\testpath

If I have mounted a volume with a drive letter say D:
then IoVolumeDeviceToDosName API will return D:

So If a volume has a mount path then I do not update certain things.

Is there any better way to get to know whether a volume has mount path or not?

NTFSD is sponsored by OSR

OSR is hiring!! Info at http://www.osr.com/careers

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295

3

Well, you should probably set an instance context with that information so
you don’t have to call IoVolumeDeviceToDosName() every time. Also, you may
want to query the information from the Mount Manager (see
http://fsfilters.blogspot.com/2012/03/volume-names.html) instead of using
IoVolumeDeviceToDosName().

Alex.

On Thu, Jul 31, 2014 at 6:53 AM, wrote:

> I am writing a minifilter driver.
> Whenever a file is opened then it comes to my IRP_MJ_CREATE then I use
>
> IoVolumeDeviceToDosName() to determine whether the request comes from a
> mount path or it has drive letter.
>
> Suppose I have mounted a volume on a folder say C:\testpath and I have not
> assigned any driveletter to it.
> then IoVolumeDeviceToDosName API will return C:\testpath
>
> If I have mounted a volume with a drive letter say D:
> then IoVolumeDeviceToDosName API will return D:
>
>
> So If a volume has a mount path then I do not update certain things.
>
> Is there any better way to get to know whether a volume has mount path or
> not?
>
> —
> NTFSD is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

4

Peter Scott :
We can not have multiple drive letter with one volume.
And I want to handle the case when there is no drive letter and only has mount path’s or path.

Alex Crap :
You mean to say InstanceSetup Callbacks??
if yes, this callback is not called on adding drive letter or removing mountpath.

I know that InstanceSetup should only be called when we actually mount the volume but in the debugger I am breaking if I remove the drive letter from the volume and it should not happen but it is happening ?

5

No, you can set an instance context from preCreate, it doesn’t have to be
from an InstanceSetup callback.

Alex.

On Fri, Aug 1, 2014 at 6:41 AM, wrote:

> Peter Scott :
> We can not have multiple drive letter with one volume.
> And I want to handle the case when there is no drive letter and only has
> mount path’s or path.
>
> Alex Crap :
> You mean to say InstanceSetup Callbacks??
> if yes, this callback is not called on adding drive letter or removing
> mountpath.
>
> I know that InstanceSetup should only be called when we actually mount the
> volume but in the debugger I am breaking if I remove the drive letter from
> the volume and it should not happen but it is happening ?
>
> —
> NTFSD is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>