EldoS | Feel safer!

Software components for data protection, secure storage and transfer

Filter notifications on SSD's

Also by EldoS: SecureBlackbox
200+ components and classes for digital security, signing, encryption and secure networking.
#32714
Posted: 03/23/2015 10:34:57
by Vladimir Cherniga (EldoS Corp.)

Hello,
yes it is points to unmanaged buffer, type of buffer defined according to control code.
#32715
Posted: 03/23/2015 10:45:12
by Chris Spiteri (Standard support level)
Joined: 10/06/2014
Posts: 57

Are the control codes defined in the sdk? If not, can you give me a code example showing how to get the values?

Thanks
#32716
Posted: 03/23/2015 13:10:21
by Vladimir Cherniga (EldoS Corp.)

Thoes are the same values you may find in msdn documentation or in sdk headers.
#32721
Posted: 03/24/2015 03:33:04
by Chris Spiteri (Standard support level)
Joined: 10/06/2014
Posts: 57

Got it, thanks.
#32977
Posted: 04/07/2015 07:51:52
by Chris Spiteri (Standard support level)
Joined: 10/06/2014
Posts: 57

Hello,

I have been testing the new trim-detection functionality by monitoring file activity on ssd drives using the filter version 3.1.84, but i have not been able to observe FSCTL_FILE_LEVEL_TRIM events in the filter, even though these are seen in ProcessMonitor.

I attached a method to the delegate OnUserFsRequest as follows:

filter.OnUserFsRequest = OnUserFsRequest;

and defined a simple event handler like this:

private void OnUserFsRequest(CallbackFilter sender, string fileName, uint userFsControlCode, System.IntPtr buffer, uint bufferLength)
{
Trace(fileName + "|USFSREQ");
}

However, this is not detecting any trim activity.

I have other event handlers to handle events like OnWriteFileN and these work well.

Would you be able to assist in troubleshooting this issue please?

Thanks and regards,

Chris
#32979
Posted: 04/07/2015 08:10:51
by Vladimir Cherniga (EldoS Corp.)

Well, did you set CbFltCallbackFlags::UserFsRequestNotify in corresponding filter rule mask ?
#32980
Posted: 04/07/2015 08:16:18
by Chris Spiteri (Standard support level)
Joined: 10/06/2014
Posts: 57

Yes, the rules mask i have defined is as follows:

private const CbFltCallbackFlags FilterFlags =
CbFltCallbackFlags.WriteNotify | CbFltCallbackFlags.SetSizesNotify
| CbFltCallbackFlags.OpenNotify | CbFltCallbackFlags.CloseNotify
| CbFltCallbackFlags.UserFsRequestNotify;

which i then use in the AddRule method as follows:

result = filter.AddFilterCallbackRule(filePath, FilterFlags);

All other event-handling works correctly except UserFsRequestNotify.
#32981
Posted: 04/07/2015 08:26:55
by Vladimir Cherniga (EldoS Corp.)

Do you have the same issue with FSCTL_SET_ZERO_DATA and FSCTL_OFFLOAD_WRITE ?
#32982
Posted: 04/07/2015 08:37:42
by Chris Spiteri (Standard support level)
Joined: 10/06/2014
Posts: 57

Thanks for your quick response.

I haven't been able to see FSCTL_SET_ZERO_DATA and FSCTL_OFFLOAD_WRITE in ProcessMonitor so far, so i cannot tell if the detection for these events is working.
#32983
Posted: 04/07/2015 08:39:05
by Vladimir Cherniga (EldoS Corp.)

Lets continue the discussion in helpdesk ticket. I will create one in a short.
Also by EldoS: Callback File System
Create virtual file systems and disks, expose and manage remote data as if they were files on the local disk.

Reply

Statistics

Topic viewed 12707 times

Number of guests: 1, registered members: 0, in total hidden: 0




|

Back to top

As of July 15, 2016 EldoS Corporation will operate as a division of /n software inc. For more information, please read the announcement.

Got it!