File system recognizer

The file system recognizer is a standard NT kernel-mode driver. It implements only one function: Check the physical media device and load the appropriate file system driver if it recognizes the format of the storage media. You might ask: Why not load all the file systems together? Because the system almost never needs to load all file system drivers, a small drive can save hundreds of K system memory. In fact, all standard NT physical media file systems use File system recognizers. For example, if the CD-ROM is not accessed, then the CDFS file system driver will not be loaded.

How does the file system recognizer know what type of file system exists on the disk? Generally, it's OK to check the identifiers on the disk. Identifiers may be stored in the partition table, and the unique value can be positioned by adding an offset from the beginning of the partition, which may be a serial number or some other identifier. These identifiers must be completely different so that incorrect file system drivers are not loaded.

Here are some common file system identities:

File system name	File System identification
HFS	0x4244
Ntfs	' NTFS '
FAT	0xe9 or 0xeb or 0x49

Table 1 common File system identifiers

When a file system program is loaded, it must analyze the disk to determine if the media contains a file system that it can recognize. If the media is a recognized file system, the file system driver will "assemble" the file system. The file system recognizer also analyzes the media to verify that there is a recognized file system. However, the file system recognizer is not "assembled" on the volume, but rather the file system driver is loaded. The file system recognizer can be uninstalled by completing the task.

Assembly process

In NT systems, a volume is assembled when it is accessed. Some volumes are assembled during system initialization, and volumes created with Disk Management programs or removable media are assembled at a later time. Therefore, when you create a new partition and assign it a letter, the volume will not be assembled until an application accesses the volume. So, when you replace the disc for the floppy drive, the volume is not assembled until a program accesses the floppy disk.

A WIN32 application accesses a volume through a disk character. The disk character is just a symbolic connection to the object Manager namespace. You can use the tools WinObj in the Platform SDK to view. A letter is a symbolic connection to a physical disk volume instead of a device created by a file system driver. When the IO Manager discovers that the device objects created for the physical storage device have File_device_disk, File_device_tape, file_device_cd_rom, or file_device_virtual_disk tags, These device objects have volume parameter blocks (Volume Parameter block). VPB is used to indicate whether the volume has been assembled. If it is already assembled, VPB points to a device object that belongs to the file system driver. If it is not assembled, the IO Manager will attempt to assemble the volume.

IO Manager is the current physical media type (File_device_disk_file_system, File_device_tape_file_system, File_device_cd_rom _file _ System) calls each registered file system driver. By invoking the driver-driven irp_mj_file_system_ control dispatch routines, the dispatch routine secondary function code is irp_mn_mount_volume and can be assembled. The driver returns information to the IO Manager whether the volume can be assembled. Call order is the first call after registration. Therefore the most frequently loaded file system driver gets the chance to assemble the volume first.

The first registration is actually the raw file system, which registers another three different file systems. When the raw file system assembles the volume, it registers the three different file systems. Volumes that belong to the raw file system can only be opened by the "All Access (whole volume)" operation. Disk Manager needs to do this.

The file system recognizer is actually a file system driver that handles only assembly requests. Therefore, it creates a device object with the appropriate file system type, registers the IO Manager as a file system, and waits for the call to assemble the volume. If the recognizer confirms that the volume belongs to its file system, it returns the error code status_fs_driver_required instead of accepting the assembly request. The IO Manager then invokes the recognizer and lets it load the entire file system driver. The specific details are sent IRP IRP_MJ _file_system_control, the secondary function code for Irp_mn_load_file_system.