写入跟踪块驱动程序的文件排除。 [英] File exclusion for write tracking block driver.

问题描述

Hello All，我有一个基于磁盘性能示例驱动程序的磁盘过滤器驱动程序，它将更改块重定向到分区上的空闲扇区。过滤器似乎在实验室中正常工作。现在我希望允许一些文件从跟踪过程中排除
，即应保存对这些文件的修改，就像在主机PC上没有运行过滤器一样。我知道在磁盘级别没有文件的概念而是块，因此我提出了以下原则。我的计划是一旦文件被指示
用于块跟踪排除我得到它的集群列表我每次驱动程序收到IRP_MJ_FLUSH_BUFFERS时都会更新集群列表让我说我有一个工作项或专用于它的系统线程任务。当收到关闭通知或IRP_MJ_FLUSH_BUFFERs
时，我将集群列表保存在注册表中，并在addDevice的某处启动，在发生任何写入之前检索它。处理IRP_MJ_WRITE操作时，我检查转换为卷偏移的磁盘偏移量是否落在群集列表中，如果是，则将
IRP传递给基础设备对象并重复以下操作。

Hello All, I have a disk filter driver based on Disk performance sample driver that redirects change block to free sectors on partitions. The filter seems to be working fine in the lab. Now I desire to allow some files to be excluded from the tracking process i.e. modifications on these files should be conserved just like there were no filter running on the host PC. I know at disk level there is no concept of file but blocks, therefore I came with the following principle. My plan is to as soon as a file is indicated for the block tracking exclusion I get its cluster list I update the cluster list each time the driver receives IRP_MJ_FLUSH_BUFFERS lets say I have a work Item or a system thread dedicated for that task. When receiving the shutdown notification or IRP_MJ_FLUSH_BUFFERs I save the cluster list in the registry and at startup somewhere in addDevice retrieve it before any write occurs . When processing an IRP_MJ_WRITE operation I check if the disk offset converted to volume offset falls within the cluster list, if yes pass the IRP to the underlying device object and repeat the following.

我尝试了测试并观察了以下内容;

I tried testing it and observed the followings;

我没有为常驻文件工作

对于非居民文件，修改没有超出文件大小，加上文件大小更改为零时发生的其他一些奇怪的错误，请删除文件文件内容。

and for non resident file the modifications didn't go beyond the file size, plus some other weird errors occurred when the file size was changed to zero let say by deleting the file file contents.

我可能听起来不专业，但我仍然在学习过程中，我们将非常感谢那些走在这条道路上的人。

I might sound not professional but I'm still in the learning process and will appreciate any insight for those that have been down this path.

等待积极回应。

谢谢。

推荐答案

我会查看文件系统迷你过滤器以使用您的磁盘过滤器。 对于使用写入权限打开且位于排除列表中的文件，您将监视文件系统级别的呼叫并从那里跟踪群集。 这具有
的优势，允许比当前文件上的方法更精细的谷物控制。 

I would look into a file system mini-filter to work with your disk filter.  For files opened with write access and which are on your exclusion list, you would monitor the file system level calls and track the clusters from there.  This has the advantage of allowing finer grain control than your current approach on the file. 

这篇关于写入跟踪块驱动程序的文件排除。的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！