Volume Sector IO

NTFSD
1

Hello,

I have logical drive that spans 2 physical drives and I’m trying to write a filter driver that intercepts sector/cluster level IO on the logical drive.

I?ve written a driver using diskperf as a base and this gives me the sector level IRP?s that I want, but it?s 2 filter devices (one for each physical drive).

I?ve also written a driver using the ?sfilter? DDK sample as a base and another using the ?swapBuffer? DDK sample, but these only seem to grant me access to file level IRP?s.

My filters are attaching to devices named "\Device\0000000X or “\Device\HarddiskVolumeX”. I presumed the latter to be correct but all of the ByteOffsets in IRP_MJ_READ or FastIoRead seem to be file based and relative to the Irp->FileObject.

Please can someone point me in the right direction?

Thank you.

2

I think I’ve answered my own question.

Disk Filter
Class=DiskDrive
ClassGuid={4D36E967-E325-11CE-BFC1-08002BE10318}

Volume Filter
Class=Volume
ClassGuid={71a27cdd-812a-11d0-bec7-08002be2092f}

3

Write a PnP filter and attach to Volume PnP class.

–
Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com

wrote in message news:xxxxx@ntfsd…
> Hello,
>
> I have logical drive that spans 2 physical drives and I’m trying to write a filter driver that intercepts sector/cluster level IO on the logical drive.
>
> I?ve written a driver using diskperf as a base and this gives me the sector level IRP?s that I want, but it?s 2 filter devices (one for each physical drive).
>
> I?ve also written a driver using the ?sfilter? DDK sample as a base and another using the ?swapBuffer? DDK sample, but these only seem to grant me access to file level IRP?s.
>
> My filters are attaching to devices named "\Device\0000000X or “\Device\HarddiskVolumeX”. I presumed the latter to be correct but all of the ByteOffsets in IRP_MJ_READ or FastIoRead seem to be file based and relative to the Irp->FileObject.
>
> Please can someone point me in the right direction?
>
> Thank you.
>