Overwrite Issue when reparsing MS word to a different volume

Hi,

In my minifilter, I reparse MS word documents to a specific path containing a temporary view.

When I try to overwrite an existing MS word document, which reparses to a different volume, The operation fails and a save dialog appears. While overwriting a MS word document that reparses to the same volume succeeds.

As you may know, While saving, MS word writes the new content to a file named WRD000n.tmp. when complete it renames the target file to a file named WRL000n.tmp as a temporary back up, I think. Then renames the WRD000n.tmp to the target file and deletes WRL000n.tmp.

Analyzing the Process Monitor log shows that after writing the temporary file content and checking that temp backup file does not exist, no rename request is sent.
So I suspect there is some logic in MS word that decides to cut the operation.

Any clue on how to continue debugging?

> Analyzing the Process Monitor log shows that after writing the temporary

file content and checking
that temp backup file does not exist, no rename request is sent.
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

I assume you do not mean this? If the file doesn’t exist it would make
sense to not rename it. Or have I mis-understood you?

Any clue on how to continue debugging?

Blood sweat and tears in my experience. Watch one working, watch one not
working, export into excel and do a difference. Check the registry.

I also find that walking away helps (or walking the dogs). You come back
and have another insight.

If you do bottom this out please share since it adds to the common knowledge
base.

I would look at the rename processing. NTFS does not support
cross-volume renames and you say that it works when reparsing to the
same volume but not a different volume, this could be saying something.

Pete


Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295

------ Original Message ------
From: xxxxx@yahoo.com
To: “Windows File Systems Devs Interest List”
Sent: 8/5/2017 1:24:45 AM
Subject: [ntfsd] Overwrite Issue when reparsing MS word to a different
volume

>Hi,
>
>In my minifilter, I reparse MS word documents to a specific path
>containing a temporary view.
>
>When I try to overwrite an existing MS word document, which reparses to
>a different volume, The operation fails and a save dialog appears.
>While overwriting a MS word document that reparses to the same volume
>succeeds.
>
>As you may know, While saving, MS word writes the new content to a file
>named WRD000n.tmp. when complete it renames the target file to a file
>named WRL000n.tmp as a temporary back up, I think. Then renames the
>WRD000n.tmp to the target file and deletes WRL000n.tmp.
>
>Analyzing the Process Monitor log shows that after writing the
>temporary file content and checking that temp backup file does not
>exist, no rename request is sent.
>So I suspect there is some logic in MS word that decides to cut the
>operation.
>
>Any clue on how to continue debugging?
>
>—
>NTFSD is sponsored by OSR
>
>
>MONTHLY seminars on crash dump analysis, WDF, Windows internals and
>software drivers!
>Details at http:
>
>To unsubscribe, visit the List Server section of OSR Online at
>http:</http:></http:>

thanks for reply,

@Rod

I assume you do not mean this? If the file doesn’t exist it would make
sense to not rename it. Or have I mis-understood you?

what I mean is step 2: (please watch for the difference between WRL and WRD)
0. I am going to save a document as a.docx

  1. MS Word saves the content as WRDnnn.tmp
  2. Then checks if WRLnnn.tmp does not exist.
  3. it renames a.docx to WRLnnn.tmp
  4. At last WRDnnn.tmp is renamed to a.docx and all set.

If you do bottom this out please share since it adds to the common knowledge base.
I probably will disappoint you when it turns out that I made some stupid mistake since I’m totally newbie. I will share the result as you asked. Just wanted you to be prepared :slight_smile:

@Peter

There is no rename request received by Process monitor neither by my filter so I got no rename to look at. Also I am testing between 2 FAT volumes.

May I debug MS word itself?

>NTFS does not support cross-volume renames

Does this mean my solution will not work on NTFS even if I get it to the point which the rename is processed?

Is there any work around? May I create the target and write the content then delete the source to simulate a rename in pre/post set information for a rename operation?