locked
When is IOCTL_DISK_COPY_DATA called? RRS feed

  • Question

  • We are building a driver for NAND-based storage device. In order to handle defragmentation requests more efficiently we plan to implement IOCTL_DISK_COPY_DATA control code, so it shuffles the internal pointers to data instead of reading/writing it.

    The problem is that our filter driver (that is UpperFilters to Disk driver) never receives this control code. I tested on XP and Windows 7 x64. I tried to catch that IOCTL right from OS startup to the moment when defragmenter is processing the drive, and it never came in.

    I'm wondering what OS versions this IOCTL is implemented in, and what should I do to make file system driver to send it down the stack. Thank you.

    Wednesday, February 29, 2012 7:24 PM

Answers

  • NTFS will generate it when doing a defrag, but it is blocked by the volume manager and partition manager on Vista and Win7

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting.

    • Marked as answer by Astron83 Thursday, March 1, 2012 11:22 PM
    Wednesday, February 29, 2012 7:50 PM

All replies

  • NTFS will generate it when doing a defrag, but it is blocked by the volume manager and partition manager on Vista and Win7

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting.

    • Marked as answer by Astron83 Thursday, March 1, 2012 11:22 PM
    Wednesday, February 29, 2012 7:50 PM
  • Thank you Brian, I'll try to catch it there then. I'm wondering what's the reason why it gets blocked

    Also do you know if it gets generated on XP? Thank you

    Wednesday, February 29, 2012 9:57 PM
  • The idea behind IOCTL_DISK_COPY_DATA is that if the disk driver implements the data move then it should do it, so for every defrag I/O the file system sends down the IOCTL_DISK_COPY_DATA to see if the drivers below are capable of moving the data.  As to why it is interceped by the volume and partition managers and failed, I don't know, but I suspect that the design/implementation isn't quite done yet, so use it at your own risk.

    I don't believe it exists in XP

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting.

    Wednesday, February 29, 2012 10:18 PM
  • Hi Brian,

    Thank you very much, I placed a filter driver as UpperFilters for volume class and now I receive this control code every time FSCTL_MOVE_FILE is sent to the file system driver.


    • Edited by Astron83 Thursday, March 1, 2012 11:38 PM
    Thursday, March 1, 2012 11:35 PM
  • I don't remember the details and the defrag algorithm and code is quite complex.  I suspect it does it in chunks of 256 clusters to avoid holding a lock for too long. As to the "missing" moves, I don't know off the top of my head; I'd have to dig through the code again to find out.

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting.

    Friday, March 2, 2012 12:05 AM
  • OK, i figured out that if FSCTL_MOVE_FILE is called with more than 256 clusters to move, then corresponding IOCTL_DISK_COPY_DATA gets truncated to 256 clusters. So in order to get it properly working the defragmenter should never move more than 256 clusters once at a time. 

    Thanks again!

    Friday, March 2, 2012 2:07 AM
  • Hi All,

    I also have a volume filter driver and want to handle IOCTL_DISK_COPY_DATA in my driver.what i have to do to handle this ioctl.


    • Edited by DRahul Thursday, June 13, 2013 3:22 PM
    Thursday, June 13, 2013 3:21 PM
  • Start here: http://msdn.microsoft.com/en-us/library/windows/hardware/ff559434(v=vs.85).aspx

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting.

    Saturday, June 15, 2013 12:16 AM
  • Sorry, I don't understand the question. What would be the point of ignoring the SourceOffset?

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting.

    Thursday, August 8, 2013 1:38 AM
  • This is sufficiently off-topic for the original thread that you need to post this as a new question

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting.

    Saturday, August 10, 2013 7:47 PM