EldoS | Feel safer!

Software components for data protection, secure storage and transfer

Differentiate between Windows and user file opens

Posted: 06/04/2015 19:43:30
by CODe (Basic support level)
Joined: 06/04/2015
Posts: 7

I'm using the CBFS mapper sample and I'm pointing it at a folder on my local system. I need to modify the file slightly when the user attempts to open the file in the virtual drive, but only when the user attempts to open it. A folder enumeration triggers a call to CbfsOpenFile when the virtual folder is opened, and CbfsOpenFile is also triggered when the user attempts to open the file themselves. I need to be able to make those file modifications in the CbfsOpenFile call ONLY when the user opens the file.

Is this possible? Thanks very much for any help and for creating such a useful product.
Posted: 06/05/2015 01:57:42
by Volodymyr Zinin (Team)

Thank you for interesting of Callback File System. It is known problem that Explorer constantly opens lots of files in order to read their thumbnails. Theoretically you can use the GetOriginatorProcess method (as well as GetOriginatorProcessId and GetOriginatorToken) from your OnOpen callback in order to get information about the process and user which is opening the file and then decide whether to perform modification or not.
BTW if you do any modification of any file or directory outside CBFS then it's necessary to notify CBFS about it by calling the NotifyDirectoryChange method.
Posted: 06/05/2015 10:10:34
by CODe (Basic support level)
Joined: 06/04/2015
Posts: 7

Thank you very much for the quick and useful response. I have tried using GetOriginatorProcessName but it always showed explorer.exe whether it was the user or Explorer. I'll give these other two methods a try to see if they prove a more useful solution and post my results shortly.

Thanks again!
Posted: 06/05/2015 11:10:09
by Volodymyr Zinin (Team)

In order to see how the program opens a file (works with it) when you double clicked on the file icon in Explorer use Process Monitor from sysinternals.com. It's a program that logs requests passed to file systems. In order to minimize logs set in Process Monitor to show only requests sent to your CBFS virtual disk. It can be done by adding a filter rule "Path"->"begins with"->"X:", where "X:" is a drive letter for your storage. The logs contains also originator of the requests, so it is easy to find what a program (Explorer or some another) performs operations.
Posted: 06/05/2015 19:54:28
by CODe (Basic support level)
Joined: 06/04/2015
Posts: 7

Unfortunately the methods mentioned did not differentiate between a user initiated CbfsOpenFile and an explorer initiated CbfsOpenFile. GetOriginatorProcessName, GetOriginatorProcessId, and GetOriginatorToken are all unable to determine the difference as they all operate as the user through explorer.

My use case: The problem I'm trying to solve is that I have placeholder/link files in the directory I'm pointing the mapper sample to and these files cannot be opened in the virtual drive. The call to CbfsOpenFile fails, but with a slight modification to the file, I can make the call to CbFsOpenFile succeed. I only want to make this succeed when the user attempts to open the file.

Hopeful solution: I've noticed a behavioral difference between the two however, when explorer attempts a directory enumeration which triggers a CbfsOpenFile, it will attempt to open the file three times before failing. When the user attempts to open the file which triggers a CbfsOpenFile, it will attempt to open the file seven times before failing. Given this behavior, I could check for repetitive calls to CbFsOpenFile within a certain time frame and on the 6th attempt, make the file modifications I need to make. If you see any issues with this approach, please do let me know. But it's the only workable solution I've come up with so far.

Again, thanks for any knowledge you can impart. I'll check back after I've implemented this solution and let you know my findings.
Posted: 06/09/2015 10:17:14
by CODe (Basic support level)
Joined: 06/04/2015
Posts: 7

The solution in my above post worked well when opening single files, but the observed behavior changed when I attempted to select multiple files and open them all at once. Unfortunately the behavior when opening multiple files is not as easily identified. Once I attempted a solution to solve opening multiple files, it incorrectly identified multiple directory enumerations by Explorer (triggered by multiple directory refreshes by the user, for example) as a user attempted open.

Unfortunately it looks like this solution won't work for my needs. Thanks for everyone's advice. If anyone else has any other potential solution, please do let me know.



Topic viewed 3254 times

Number of guests: 1, registered members: 0, in total hidden: 0


Back to top

As of July 15, 2016 EldoS business operates as a division of /n software, inc. For more information, please read the announcement.

Got it!