Filtering floppy operations with minifilter driver

[Eugene]

I want to filter floppy disks operations with the file system minifilter
driver. The problem is that I cannot attach minifilter to the drive unless
the disk is inserted. If disk is not inserted into the drive, the
FilterAttach function returns error (ERROR_FLT_DELETING_OBJECT (0X801F000B)
for Windows XP and ERROR_FLT_VOLUME_NOT_FOUND (0x 801F0014) for Windows 7).
When the disk is inserted, all works fine. After ejecting/inserting the disk
minifilter continues to work properly.

Is there any way to attach minifilter to the floppy drive without physical
disk inserted into it?

Thanks, Eugene

[Don Burn]

No because until the disk is inserted there is no filesystem to attach to.


Don Burn (MVP, Windows DKD)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

-----Original Message-----
Posted At: Thursday, May 27, 2010 5:20 PM
Posted To: microsoft.public.development.device.drivers
Conversation: Filtering floppy operations with minifilter driver
Subject: Filtering floppy operations with minifilter driver
I want to filter floppy disks operations with the file system minifilter
driver. The problem is that I cannot attach minifilter to the drive
unless the
disk is inserted. If disk is not inserted into the drive, the
FilterAttach
function returns error (ERROR_FLT_DELETING_OBJECT (0X801F000B) for
Windows XP
and ERROR_FLT_VOLUME_NOT_FOUND (0x 801F0014) for Windows 7).
When the disk is inserted, all works fine. After ejecting/inserting the disk
minifilter continues to work properly.
Is there any way to attach minifilter to the floppy drive without physical
disk inserted into it?
Thanks, Eugene
__________ Information from ESET Smart Security, version of virus
signature
database 5151 (20100527) __________
The message was checked by ESET Smart Security.
http://www.eset.com

[Eugene]

Thanks, Don.
So, why minifilter is working when floppy is ejected and then iniserted again?
Maybe, the filesystem is created when the first floppy is inserted and then
exists after it is ejected?
Is there any way to receive notification when the floppy is inserted (in
kernel mode or in user mode)?

Thanks, Eugene

Post by Don Burn
No because until the disk is inserted there is no filesystem to attach to.
Don Burn (MVP, Windows DKD)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

-----Original Message-----
Posted At: Thursday, May 27, 2010 5:20 PM
Posted To: microsoft.public.development.device.drivers
Conversation: Filtering floppy operations with minifilter driver
Subject: Filtering floppy operations with minifilter driver
I want to filter floppy disks operations with the file system minifilter
driver. The problem is that I cannot attach minifilter to the drive
unless the
disk is inserted. If disk is not inserted into the drive, the
FilterAttach
function returns error (ERROR_FLT_DELETING_OBJECT (0X801F000B) for
Windows XP
and ERROR_FLT_VOLUME_NOT_FOUND (0x 801F0014) for Windows 7).
When the disk is inserted, all works fine. After ejecting/inserting the disk
minifilter continues to work properly.
Is there any way to attach minifilter to the floppy drive without physical
disk inserted into it?
Thanks, Eugene
__________ Information from ESET Smart Security, version of virus
signature
database 5151 (20100527) __________
The message was checked by ESET Smart Security.
http://www.eset.com

.

[Günter Prossliner]

Hello,

Post by Eugene
So, why minifilter is working when floppy is ejected and then
iniserted again?

IIRC the "eject" of a Floppy is just a mechanical operation. If it's
inserted again and there is not disk-request in the meantime, the OS don't
known that the Floppy has ever been ejected.


GP

[Maxim S. Shatskih]

Post by Eugene
Maybe, the filesystem is created when the first floppy is inserted and then
exists after it is ejected?

No, it is created on first software access to the floppy.

[Eugene]

Thanks, Günter and Maxim!
And what about notification? Is there a way to receive notification when the
file system is created? Without this how can i attach minifilter to the
floppy drive?

Post by Maxim S. Shatskih

Post by Eugene
Maybe, the filesystem is created when the first floppy is inserted and then
exists after it is ejected?

No, it is created on first software access to the floppy.
--
Maxim S. Shatskih
Windows DDK MVP
http://www.storagecraft.com
.

[Eugene]

Thanks to All!
The solution appears to be rather simple: minifilter has to register
PFLT_INSTANCE_SETUP_CALLBACK procedure (in the FltRegisterFilter
call) and return STATUS_SUCCESS from it. This ensures that minifilter will
be attached to all volumes.
Eugene.