Hi,

I installed a upper class filter driver to disk drives to track down
the irps passing towards disks. I connected a usb mass storage device
( eg: sd card) with ntfs file system. When I just click on the newely
created drive found in explorer, my filter driver gets few
IRP_MJ_WRITE irps which was not expected.

If it is a FAT file system, IRP_MJ_WRITE will not come when I just
access driver or folders..

To disable the NTFS last access time stamp, I updated registry as
given below.And restarted the machine.

System Key: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\FileSystem]
Value Name: NtfsDisableLastAccessUpdate
Data Type: REG_DWORD (DWORD Value)
Value Data: 1

But still my filter driver gets IRP_MJ_WRITE, when accesing NTFS drive
and foldes. Please help me to know the reason behind this.

Problem is that I am developing a software for controlling the
read/write irps to a particular disk. so when I block IRP_MJ_WRITE
from ntfs file system, it will not show the folders in the explorer.

regards
John

Log writes from NTFS. They do occur.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com

"John" <johnav@gmail.com> wrote in message
news:dfe06071.0411250529.37bc64eb@posting.google.c om...

Maxim S. Shatskih wrote:

--

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032

Do you want to just make your disk read-only?
That's, to prevent all writes?
--PA

"John" wrote:

Hi all,

Thanks for your reply.

I want to control the read/write access to my usb msc device throgh my
disk filter. My disk filter exports two ioctls.

1. IOCTL_DISKFILT_BLOCK_WRITE -:Blocks all write irps to the device
2. IOCTL_DISKFILT_BLOCK_READ_WRITE-:Blocks all read and write irps to
the device

But when I block all write irps, I expect that user can browse the
files and folders in my storage device. This is happening if the file
system is FAT.


Is there any way to distinguish these log write irp's from ntfs ?.
To implement my requirement as stated above, what type of filter I
need to install. Please note that I am not implementing file access
control. So I can't write a file system driver. I need to control the
access to device itself.

regards
John

"Pavel A." <pavel_a@NOwritemeNO.com> wrote in message news:<6B0619DB-EA0B-4FF0-98B7-3415C7DBF3BD@microsoft.com>...

John wrote:
Well that is a bit of a problem. As a disk filter you really don't have
the right level of knowledge. Basically all you have are offsets and
lengths. You can tell paging IO from non-paging IO, but that is about
it. A fs filter driver would have better control: you could for example
simply deny create requests that attempt to acquire write access.

--

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032

You must also fail IOCTL_DISK_IS_WRITABLE in your filter, and do this before
the FSD is mounted.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com