Detecting metadata-only read requests in windows filesystem
Posted
by HyLian
on Stack Overflow
See other posts from Stack Overflow
or by HyLian
Published on 2009-10-29T13:46:37Z
Indexed on
2010/06/13
0:02 UTC
Read the original article
Hit count: 157
Hello,
I'm developing a kind of filesystem driver. All of read requests that windows makes to my filesystem goes by the driver implementation.
I would like to distinguish between "normal" read requests and those who want to get only the metadata from the file. ( Windows reads first 4K of the file and then stop reading ).
Does Windows mark this metadata reads in some way? It would be very useful in order to treat that two kind of operations in a different way.
In a typical CreateFile call, we have AccessMode, ShareMode, CreationDisposition and FlagsAndAttributes parameters ( being DWORD ), i'm not sure if it's possible to extract some clue of the operation requested.
Thanks for reading :)
© Stack Overflow or respective owner