通过File System Minifilter Driver跟踪卷更改的块。 [英] Tracking the volume changed blocks by the File System Minifilter Driver.

问题描述

我正在处理文件系统微过滤器驱动程序，它必须跟踪卷更改的块。

在PreWrite期间/ PostWrite回调我收到文件写入部分的偏移量：长度对，它具有基于文件的偏移量。所以我需要将它从基于文件的偏移量转换为基于体积的偏移量。

是否可以通过从该层上的VCN获取LCN来实现它？

或者我应该只使用一个Volume Driver模型来进行这样的跟踪？

解决方案

使用卷过滤器肯定会更容易。   注意：我没说简单，因为音量过滤器基本上没有记录。  我在FSCTL_GET_RETRIEVAL_POINTERS和FSCTL_QUERY_RETRIEVAL_POINTERS
的迷你过滤器中进行了一些简约跟踪，但这仅适用于特殊情况，而不适用于整个音量。

Hi,

I am working on File System Minifilter Driver which must track the volume changed blocks.

During PreWrite/PostWrite callback I receive the offset:length pair of the file write portion which have a file based offset. So I need to convert it from file based offset to volume based offset.

Is it possible to do it by getting LCN from VCN on that layer?

Or I should use just a Volume Driver model for such tracking?

解决方案

This is definitely easier with a Volume Filter.   Note: I did not say easy, since volume filters are basically undocumented.   I have done some minimalistic tracking in a mini-filter with FSCTL_GET_RETRIEVAL_POINTERS and FSCTL_QUERY_RETRIEVAL_POINTERS but this only works for special cases, not the whole volume.

这篇关于通过File System Minifilter Driver跟踪卷更改的块。的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！