\$Extend\$Quota:$Q:$INDEX_ALLOCATION failed: 0xC000000D(STATUS_INVALID_PARAMETER)

NTFSD
1

Hi guys,

I wrote a mini filter driver in Win 7 to redirect file I/Os from "C:" (\Harddisk0\Volume2) to
“D:\Vm\C” (D: is \Harddisk0\Volume5) directory, and encountered some issues when querying the quota of C drive.

When opening “\Harddisk0\Volume2$Extend$Quota:$Q:$INDEX_ALLOCATION”, it will be redirected to open “\Harddisk0\Volume5\Vm\C$Extend$Quota:$Q:$INDEX_ALLOCATION”, which did not exist by default:

// The path in PTargetFileAttributes is “\Harddisk0\Volume5\Vm\C$Extend$Quota:$Q:$INDEX_ALLOCATION”

Status = FltCreateFileEx2( FilterHandle, // Filter
PInstance, // Instance
&FileHandle, // Returned Handle
&FileObj, // Returned FileObject
FILE_LIST_DIRECTORY|SYNCHRONIZE, // Desired Access
PTargetFileAttributes, // object attributes
&StatusBlock, // Returned IOStatusBlock
0, // Allocation Size
FILE_ATTRIBUTE_NORMAL, // File Attributes
FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE, // Share Access
FILE_OPEN, // Create Disposition
FILE_DIRECTORY_FILE|
FILE_SYNCHRONOUS_IO_NONALERT|
FILE_OPEN_REPARSE_POINT, // Create Options
NULL, // Ea Buffer
0, // EA Length
IO_IGNORE_SHARE_ACCESS_CHECK, // Flags
NULL);

Here comes the questions:

  1. Instead of returning STATUS_PATH_NOT_FOUND, FltCreateFileEx2 returned 0xC000000D(STATUS_INVALID_PARAMETER), why?

  2. How to copy the content/attributes of stream “$Extend$Quota:$Q:$INDEX_ALLOCATION” from drive "C:" to “D:\Vm\C” directory?

Thanks,

Jason

2

> 1. Instead of returning STATUS_PATH_NOT_FOUND, FltCreateFileEx2 returned

0xC000000D(STATUS_INVALID_PARAMETER), why?

Its not clear which open you are talking about. If it is the open of:

\Harddisk0\Volume2$Extend$Quota:$Q:$INDEX_ALLOCATION

Then its because it wants to. That is a n NTFS metadata file and unless you
can find documentation about it you had better leave it alone.

If it is of

\Harddisk0\Volume5\Vm\C$Extend$Quota:$Q:$INDEX_ALLOCATION

That is an attribute (?) called “$INDEX_ALLOCATION” of a stream called “$Q”.
So it cannot be a directory

  1. How to copy the content/attributes of stream
    “$Extend$Quota:$Q:$INDEX_ALLOCATION” from drive "C:" to “D:\Vm\C”
    directory?

Why do you want to. That is a metadata file and so to all intents and
purposes it is read only.

3

> Why do you want to. That is a metadata file and so to all intents and
> purposes it is read only

The reason is that since the whole C drive was munged to “D:\Vm\C” directory by “Copy-On-Write” mechanism, when user query the quota of C drive, it will be redirected from “C:$Extend$Quota…” to “D:\Vm\C$Extend$Quota…”.

My driver really don’t care about the format/content in $Quota metadata file, what the driver care is copying the metadata file to “D:\Vm\C$Extend” and open it there.

Since the “C:$Extend$Quota…” was a directory and $INDEX_ALLOCATION was a special attributes of it, as a workaround to 0xC000000D error when opening “D:\Vm\C$Extend$Quota:$Q:$INDEX_ALLOCATION” directly, my driver tried to create the “D:\Vm\C$Extend$Quota” directory first and then copied quota related attributes from “C:$Extend$Quota…” to “D:\Vm\C$Extend$Quota…”.

But, how to copy the $INDEX_ALLOCATION attribute?