拦截对磁盘块的写入。此操作将驻留在什么级别？在FS层还是在LVM和FS之间？
场景：
您在 Windows 7 中打开 notepad.exe。写入 1024 个字符并保存文件。 Windows显然将这个文件保存到硬盘上。此时我可以确定数据写入哪个块。一个简单的文件监视器会给我通知事件的信息，但在文件系统层，它是否还包括数据写入的块？鉴于文件小于 4kb，它将仅使用 1 个块。文件系统知道它将去往哪个块吗？
有人可以更深入地解释一下这个过程吗？在堆栈的哪一层确定数据最终将进入哪个块。在文件系统级别使用驱动程序的文件监视器是否能保证最终的块目的地？或者这是在文件系统层和逻辑卷层之间确定的，这意味着我需要一个上层卷过滤器驱动程序？
Scenario:
You open notepad.exe in Windows 7. Write 1024 characters and save the file. Windows obviously saves this file to the hard disk. At which point can I determine what block the data is written to. A simple file monitor will give me the information notifying me of the event, but at the filesystem layer, does it also include the block that the data was written to? Given the file is under 4kb, it will only use 1 block. Does the filesystem KNOW which block it will go to?
Can someone explain the process a little more in depth? At what layer in the stack does the determination of which block the data will end up in. Does a file monitor that utilizes a driver at the filesystem level guarantee the final block destination? Or is this determined between the filesystem layer and the logical volume layer meaning I would need an upper volume filter driver?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
文件系统驱动程序（或者甚至可能低于级别，具体取决于您是否对 HDD 盘上文件的物理位置的簇号感兴趣）决定数据进入哪个块（或簇）。我不确定即使使用卷过滤器驱动程序您是否能够链接文件和块。总而言之，文件可以是稀疏的、压缩的或加密的，即使有文件系统过滤器捕获数据（将它们与保存到块的数据匹配），您也无法进行匹配。如果您解释跟踪的目的是什么，也许有人会提出比构建一堆过滤器驱动程序更好的主意。
The file system driver (or maybe even below level, depending whether you are interested in cluster number of physical location of the file on the plate of the HDD) decides what block (or cluster) the data goes to. I am not sure that even using volume filter driver you would be able to link the file and the block. All in all the file can be sparse or compressed or encrypted, and even having a file system filter capturing the data (to match them to the data being saved to the block) you won't be able to do the match. If you explain what the purpose of your tracking is, maybe someone will come with a better idea, than building a bunch of filter drivers.