3

I have a software that is tracking an NTFS volume changes on a Windows OS using volume filter driver. I need to handle a condition when the volume gets mounted and modified outside of the OS where my driver is installed.

Is it possible to figure out the "last mount time" of the volume? or any other parameter allowing me to tell if the volume has been mounted outside of my driver control?

3
  • Do you mean mounted by Windows, or mounted by any tool (like a Linux NTFS driver)?
    – Gabe
    Jun 7, 2012 at 20:17
  • Any tool, but if you have Windows-only solution I'd appreciate it :)
    – Isso
    Jun 7, 2012 at 20:18
  • Thank you, great hint! The only problem is that not every volume has USN journal enabled
    – Isso
    Jun 7, 2012 at 20:23

1 Answer 1

2

I don't know of a "last mount time", but there is a "log file open count". If you look at http://www.opensource.apple.com/source/ntfs/ntfs-64/kext/ntfs_logfile.h, you will see a RESTART_AREA structure like this:

/* 40*/ le32 restart_log_open_count;/* A counter that gets incremented every
                                     time the logfile is restarted which happens
                                     at mount time when the logfile is opened.
                                     When creating set to a random value.  Win2k
                                     sets it to the low 32 bits of the current
                                     system time in NTFS format (see time.h). */
/* 44*/ le32 reserved;      /* Reserved/alignment to 8-byte boundary. */
/* sizeof() = 48 (0x30) bytes */
} __attribute__((__packed__)) RESTART_AREA;

You can see that near the end of it is a restart_log_open_count that you can use to keep track of mounts. You would look at the value and compare it to a saved value. It should be equal to the saved value plus one. If so, it hasn't been mounted since you last had control.

1
  • Thank you so much! Just created a test program to check it - and indeed - the value gets incremented properly every time the volume is mounted.
    – Isso
    Jun 8, 2012 at 18:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.