How to block particular drive through minispy filesystem

NTFSD
1

Hello,
I am new to Filesystem Minispy and i am working towards kernal side.
As by using PreOperationCallback function , inside it …I am trying to block the Drive through
Data->IoStatus.Status = STATUS_ACCESS_DENIED;

So i am facing problem whenever i am inserting 2nd pendrive its blocking all usb drives.
So i want a help in blocking only particular drive.
i am getting Volume name through
FltGetFileNameInformation( Data,FLT_FILE_NAME_NORMALIZED |MiniSpyData.NameQueryMethod, &nameInfo);

VolumeName received by nameInfo i want to block this particular drive

2

You can use one of the following option

Option-1

See if you can use InstanceSetupCallback - https://msdn.microsoft.com/en-us/library/windows/hardware/ff551096(v=vs.85).aspx
Also, calling this FltGetVolumeGuidName from InstanceSetupCallback (https://msdn.microsoft.com/en-us/library/windows/hardware/ff543230(v=vs.85).aspx)

Option-2

You can suppress auto attachments
Instance1.Flags = 0x1 ; Suppress automatic attachments
and call FltAttachVolume from kernel or FilterAttach from user mode

3

Actually before blocking i am attaching USB drives in user side and blocking am doing in kernel side.
As i insert 2nd pendrive my both drives getting blocked. I want by drives to have different functionality like 1st shud be blocked and 2nd should be allowed.

4

What pre-Operation are you failing with ACCESS_DENIED? If you are
failing pre-create, how are you differentiating between opens on the
different volumes?

Pete

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com http:</http:>
866.263.9295

------ Original Message ------
From: xxxxx@gmail.com
To: “Windows File Systems Devs Interest List”
Sent: 6/8/2015 2:24:50 AM
Subject: [ntfsd] How to block particular drive through minispy
filesystem

>Hello,
> I am new to Filesystem Minispy and i am working towards kernal side.
>As by using PreOperationCallback function , inside it …I am trying to
>block the Drive through
>Data->IoStatus.Status = STATUS_ACCESS_DENIED;
>
>So i am facing problem whenever i am inserting 2nd pendrive its
>blocking all usb drives.
>So i want a help in blocking only particular drive.
>i am getting Volume name through
>FltGetFileNameInformation( Data,FLT_FILE_NAME_NORMALIZED
>|MiniSpyData.NameQueryMethod, &nameInfo);
>
>VolumeName received by nameInfo i want to block this particular drive
>
>—
>NTFSD is sponsored by OSR
>
>OSR is hiring!! Info at http://www.osr.com/careers
>
>For our schedule of debugging and file system seminars visit:
>http://www.osr.com/seminars
>
>To unsubscribe, visit the List Server section of OSR Online at
>http://www.osronline.com/page.cfm?name=ListServer

5

What I would do is have a bit in the instance/volume context, saying something like:
bIsVolumeAllowed.

When all the requests come to this instance/volume just complete them with access denied.

So most of your work is done in instance setup, there you must know for sure which instance is a pass through and which one is blocked.