Detect when a new virtual drive is created

Question

How can I know what trueCrypt volumes are mounted on a computer?

Note I already know what files can be mounted. In other words the only volumes that can be mounted are: C:\Vol1.tc, C:\Vol2.tc and C:\Vol3.tc.

How do I know when a volume is dismounted?

I manage to do that by using the .net class FileSystemWatcher. Every time I dismount a volume I notice that the event FileSystemWatcher.Changed fires.

How do I know when a volume is mounted?

Here is where I am having trouble! Do I constantly query the drives and see if a drive exists. That sounds like a bad idea because if someone plugs in a usb and windows assigns that drive letter to it I will have an error. How can I know when a new virtual drive is created?

Why I need this?

I am required to create an application where the user can see what trueCrypt volumes are mounted from his phone. The only thing I am missing to do is find out when a volume is mounted...

Answer 1

As Eugene Mayevski 'EldoS Corp commented, you should use the WM_DEVICECHANGE event.

In combination with the answer I gave to you on this question, here is a sample Code :

class Program : System.Windows.Forms.Form
{
    static void Main(string[] args)
    {
        System.Windows.Forms.Application.Run(new Program());
    }

    const int WM_DEVICECHANGE = 0x0219;
    const int NB_MOUNTED_VOLUMES = 26;
    protected override void WndProc(ref System.Windows.Forms.Message m)
    {
        switch (m.Msg)
        {
            case WM_DEVICECHANGE:
                ShowChange();
                break;
        }
        base.WndProc(ref m);
    }

    private String[] m_oldMount;
    public Program()
    {
        m_oldMount = new String[NB_MOUNTED_VOLUMES];
        for (int i = 0; i < NB_MOUNTED_VOLUMES; i++)
            m_oldMount[i] = String.Empty;
    }

    private void ShowChange()
    {
        String[] currentMount = GetMountList();
        for (int i = 0; i < NB_MOUNTED_VOLUMES; i++)
        {
            if (currentMount[i] != m_oldMount[i])
            {
                if (String.IsNullOrEmpty(currentMount[i]))
                {
                    Console.WriteLine("{0} : Dismount on {1}: => {2}",
                        DateTime.Now,
                        (char)('A' + i),
                        m_oldMount[i]);
                }
                else
                {
                    Console.WriteLine("{0} : Mount on {1}: => {2}",
                        DateTime.Now,
                        (char)('A' + i),
                        currentMount[i]);
                }
            }
        }
        m_oldMount = currentMount;
    }
    private String[] GetMountList()
    {
        uint size = (uint)Marshal.SizeOf(typeof(MOUNT_LIST_STRUCT));
        IntPtr buffer = Marshal.AllocHGlobal((int)size);
        uint bytesReturned;
        IntPtr _hdev = CreateFile("\\\\.\\TrueCrypt", FileAccess.ReadWrite, FileShare.ReadWrite, IntPtr.Zero, FileMode.Open, 0, IntPtr.Zero);
        bool bResult = DeviceIoControl(_hdev, TC_IOCTL_GET_MOUNTED_VOLUMES, buffer, size, buffer, size, out bytesReturned, IntPtr.Zero);
        MOUNT_LIST_STRUCT mount = new MOUNT_LIST_STRUCT();
        Marshal.PtrToStructure(buffer, mount);
        Marshal.FreeHGlobal(buffer);

        return mount.wszVolume.Select(m => m.ToString()).ToArray();
    }

    [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi, Pack = 1)]
    class MOUNT_LIST_STRUCT
    {
        public readonly UInt32 ulMountedDrives; /* Bitfield of all mounted drive letters */
        [MarshalAs(UnmanagedType.ByValArray, SizeConst = 26)]
        public readonly MOUNT_LIST_STRUCT_VOLUME_NAME[] wszVolume;  /* Volume names of mounted volumes */
        [MarshalAs(UnmanagedType.ByValArray, SizeConst = 26)]
        public readonly UInt64[] diskLength;
        [MarshalAs(UnmanagedType.ByValArray, SizeConst = 26)]
        public readonly int[] ea;
        [MarshalAs(UnmanagedType.ByValArray, SizeConst = 26)]
        public readonly int[] volumeType;   /* Volume type (e.g. PROP_VOL_TYPE_OUTER, PROP_VOL_TYPE_OUTER_VOL_WRITE_PREVENTED, etc.) */
    }

    [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi, Pack = 1)]
    struct MOUNT_LIST_STRUCT_VOLUME_NAME
    {
        [MarshalAs(UnmanagedType.ByValArray, ArraySubType = UnmanagedType.I2, SizeConst = 260)]
        public readonly char[] wszVolume;   /* Volume names of mounted volumes */

        public override string ToString()
        {
            return (new String(wszVolume)).TrimEnd('\0');
        }
    }

    public static int CTL_CODE(int DeviceType, int Function, int Method, int Access)
    {
        return (((DeviceType) << 16) | ((Access) << 14) | ((Function) << 2)
          | (Method));
    }
    private static readonly uint TC_IOCTL_GET_MOUNTED_VOLUMES = (uint)CTL_CODE(0x00000022, 0x800 + (6), 0, 0);

    [DllImport("kernel32.dll", ExactSpelling = true, SetLastError = true, CharSet = CharSet.Auto)]
    static extern bool DeviceIoControl(IntPtr hDevice, uint dwIoControlCode,
    IntPtr lpInBuffer, uint nInBufferSize,
    IntPtr lpOutBuffer, uint nOutBufferSize,
    out uint lpBytesReturned, IntPtr lpOverlapped);

    [DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
    public static extern IntPtr CreateFile(
         [MarshalAs(UnmanagedType.LPTStr)] string filename,
         [MarshalAs(UnmanagedType.U4)] FileAccess access,
         [MarshalAs(UnmanagedType.U4)] FileShare share,
         IntPtr securityAttributes, // optional SECURITY_ATTRIBUTES struct or IntPtr.Zero
         [MarshalAs(UnmanagedType.U4)] FileMode creationDisposition,
         [MarshalAs(UnmanagedType.U4)] FileAttributes flagsAndAttributes,
         IntPtr templateFile);
}