Detecting metadata-only read requests in windows filesystem

Posted by HyLian on Stack Overflow See other posts from Stack Overflow or by HyLian
Published on 2009-10-29T13:46:37Z Indexed on 2010/06/13 0:02 UTC
Read the original article Hit count: 142

Filed under:
|
|
|
|

Hello,

I'm developing a kind of filesystem driver. All of read requests that windows makes to my filesystem goes by the driver implementation.

I would like to distinguish between "normal" read requests and those who want to get only the metadata from the file. ( Windows reads first 4K of the file and then stop reading ).

Does Windows mark this metadata reads in some way? It would be very useful in order to treat that two kind of operations in a different way.

In a typical CreateFile call, we have AccessMode, ShareMode, CreationDisposition and FlagsAndAttributes parameters ( being DWORD ), i'm not sure if it's possible to extract some clue of the operation requested.

Thanks for reading :)

© Stack Overflow or respective owner

Related posts about c++

Related posts about Windows