File System Filter Driver: Creating a Defragmenter

Question

I've just started working on a file system filter driver that monitors for I/O writes to any file (listening for IRP_MJ_WRITE requests), and defragments the file transparently if it becomes fragmented.

Currently, I have code like this:

NTSTATUS FsFilterDispatchWrite(__in PDEVICE_OBJECT DeviceObject, __in PIRP Irp)
{
    PFILE_OBJECT pFileObject = IoGetCurrentIrpStackLocation(Irp)->FileObject;
    NTSTATUS result = FsFilterDispatchPassThrough(DeviceObject, Irp);
    //FltFsControlFile(???);
    return result;
}

in which I would need to issue the FSCTL_GET_RETRIEVAL_POINTERS I/O control code.

However, I'm rather new to the area of driver development... is FltFsControlFile the correct function for me to use here? If so, what does the Instance parameter represent? And if not, then how should I go about doing this?

Answer 1

Merhad,

FltFsControlFile is the correct API to use, but rememeber its not worth doing defragmentation from a filter driver, doing defrag on IO path (or from a worker thread will be highly in-efficient) in kernel mode is highly in efficient.

Windows made most of the files defragable from user mode. check http://technet.microsoft.com/en-us/library/dd405526(VS.85).asp and http://technet.microsoft.com/en-us/library/aa364577(VS.85).aspx

To monitor the FS activities the better thing to do is using USN journal, which is very efficient. Does not impose any load to the system

http://technet.microsoft.com/en-us/library/aa365736(VS.85).aspx