How to simulate attaching to "HarddiskVolumeShadowCopyN"

Hi all.

We have a filter driver, which attaches to different device-types. We log
the device names in a log file.

Occasionally, on some systems running the filter driver, we observe device
kernel-names like type "\Device\HarddiskVolumeShadowCopy14", but we haven't
been able to reproduce the issue consistently.

Is there a consistent way to replicate attaching to devices of such type?

We managed to hit upon, while creating restore point on Vista.

In our code, we use
"FILE_DEVICE_VIRTUAL_DISK == StorageStackDeviceObject->DeviceType"
as the check (where "StorageStackDeviceObject is "PDEVICE_OBJECT" object),
to check for shadow-volumes in WIN-2003 and above. However, the test fails
for Vista.

Has there been a change in the device-type enumeration for Vista?

Will be grateful for a reply.

Regards
Ajay

"Ajay" wrote:

> Hi all.
>
> We have a filter driver, which attaches to different device-types. We log
> the device names in a log file.
>
> Occasionally, on some systems running the filter driver, we observe device
> kernel-names like type "\Device\HarddiskVolumeShadowCopy14", but we haven't
> been able to reproduce the issue consistently.
>
> Is there a consistent way to replicate attaching to devices of such type?

> "FILE_DEVICE_VIRTUAL_DISK == StorageStackDeviceObject->DeviceType"
> as the check (where "StorageStackDeviceObject is "PDEVICE_OBJECT" object),
> to check for shadow-volumes in WIN-2003 and above. However, the test fails

Get the driver object name using ObQueryNameString and compare it to \Driver\volsnap

--
Maxim S. Shatskih
Windows DDK MVP

http://www.storagecraft.com