FltGetVolumeFromName fails with error 0xc01c0014

NTFSD
1

Hi,

My minifilter is failing to attach a perticular volume of a drive. After debugging I found that the call to function FltGetVolumeFromName returns 0xc01c0014. The volume GUID name is passed to the function FltGetVolumeFromName. The same problem is not occurring for other volumes present on the same system.

Thanks for your help!

~Manoj

2

The docs say you should pass a non-persistent or DOS-device name, not a GUID (though I guess it could work).
Where are you calling the API? There are probably other ways to get a volume pointer there.

Regards, Dejan.

xxxxx@gmail.com wrote:

Hi,

My minifilter is failing to attach a perticular volume of a drive. After debugging I found that the call to function FltGetVolumeFromName returns 0xc01c0014. The volume GUID name is passed to the function FltGetVolumeFromName. The same problem is not occurring for other volumes present on the same system.

Thanks for your help!

~Manoj

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

–
Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.

3

Hi Dejan,

Thanks for your reply.

My minifilter is working with all other volumes except a perticular volume for which it is failing. So I don’t think passing Volume GUID have any problem.

I am calling API FltGetVolumeFromName after my minifilter loads and before calling FltAttachVolume. Volume names in GUID form to which my minifilter needs to attach are recieved from an user application.

Hope this will help.

Thanks
Manoj

4

Well, if it doesn’t work for that volume there is a possible case where GUID does not work.
Is this in your message processing code (i.e. when your driver receives an IOCTL/Message from user mode application), during InstanceSetup or other routine?

Is the volume a regular volume, a VS snapshot, network volume, etc.? If it is a regular volume, I don’t have any idea why it doesn’t work for that volume only. Do make sure the GUID is actually proper -
and try converting the GUID into a non-persistant name in user mode for a test of whether it works.

Dejan.

xxxxx@gmail.com wrote:

Hi Dejan,

Thanks for your reply.

My minifilter is working with all other volumes except a perticular volume for which it is failing. So I don’t think passing Volume GUID have any problem.

I am calling API FltGetVolumeFromName after my minifilter loads and before calling FltAttachVolume. Volume names in GUID form to which my minifilter needs to attach are recieved from an user application.

Hope this will help.

Thanks
Manoj

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

–
Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.

5

As Dejan said, volume guid may be no longer valid.

STATUS_FLT_VOLUME_NOT_FOUND (=0xc01c0014)
could you please look at “!fltkd.volumes/!fltkd.volume” list if you find
such volume?

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@gmail.com
Sent: Wednesday, May 18, 2011 12:27 PM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] FltGetVolumeFromName fails with error 0xc01c0014

Hi Dejan,

Thanks for your reply.

My minifilter is working with all other volumes except a perticular volume
for which it is failing. So I don’t think passing Volume GUID have any
problem.

I am calling API FltGetVolumeFromName after my minifilter loads and before
calling FltAttachVolume. Volume names in GUID form to which my minifilter
needs to attach are recieved from an user application.

Hope this will help.

Thanks
Manoj

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

6

A volume GUID will remain valid during a session. The volume might not be valid, though.

Petr Kurtin wrote:

As Dejan said, volume guid may be no longer valid.

STATUS_FLT_VOLUME_NOT_FOUND (=0xc01c0014)
could you please look at “!fltkd.volumes/!fltkd.volume” list if you find
such volume?

–
Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.

7

It seems no luck. I tried to change the volume GUID name to Dos device name and still getting the same error.

I am trying to do it in message processing code. The volume is a regular volume.

Thanks
Manoj

8

Have you been able to find the given volume in “!fltkd.volumes” global list?
Is this volume aleady filtered by fltmgr? Does it have a known PFLT_VOLUME
you’re looking for? FltGetVolumeFromName is a very simple function, it just
opens DeviceObject for the volume (ZwCreateFile + IoGetRelatedDeviceObject)
and then finds DeviceObject for the given PFLT_VOLUME in fltmgr’s global
volume list.

Petr

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@gmail.com
Sent: Thursday, May 19, 2011 10:07 AM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] FltGetVolumeFromName fails with error 0xc01c0014

It seems no luck. I tried to change the volume GUID name to Dos device name
and still getting the same error.

I am trying to do it in message processing code. The volume is a regular
volume.

Thanks
Manoj

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

9

Give us an example of the volumes that work and the one that doesn’t.

xxxxx@gmail.com wrote:

It seems no luck. I tried to change the volume GUID name to Dos device name and still getting the same error.

I am trying to do it in message processing code. The volume is a regular volume.

–
Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.

10

Hi Dejan,

What do you mean by example of the volumes? All volumes are on local attached disk and are basic volumes. What other properties you want?

Hi Petr,

Unfertunately this machine is a production box and I cannot debug it.

Are there any other way to get the volume instance from volume name?

Thanks
Manoj

11

You can’t even get a crasdump?

That makes things kind of hard.

Mm
On May 20, 2011 1:28 AM, wrote:
> Hi Dejan,
>
> What do you mean by example of the volumes? All volumes are on local
attached disk and are basic volumes. What other properties you want?
>
> Hi Petr,
>
> Unfertunately this machine is a production box and I cannot debug it.
>
> Are there any other way to get the volume instance from volume name?
>
> Thanks
> Manoj
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

12

I can try to get a crash dump. Can I use KeBugCheckEx in minifilter driver code to dump the system forcibly?

Thanks
Manoj

13

yes and generate kernel-dump

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@gmail.com
Sent: Friday, May 20, 2011 8:47 AM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] FltGetVolumeFromName fails with error 0xc01c0014

I can try to get a crash dump. Can I use KeBugCheckEx in minifilter driver
code to dump the system forcibly?

Thanks
Manoj

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

14

Give us the actual names of the volumes on that machine, and specify which is the one that fails.
You can list all volumes with “FLTMC VOLUMES” on the command prompt. And you should know (from your debug output or some other way) which
volume name the call fails for.

xxxxx@gmail.com wrote:

Hi Dejan,

What do you mean by example of the volumes? All volumes are on local attached disk and are basic volumes. What other properties you want?

Hi Petr,

Unfertunately this machine is a production box and I cannot debug it.

Are there any other way to get the volume instance from volume name?

Thanks
Manoj

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

–
Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.