Re: How to block system copy commands at driver level

Tech-Archive recommends: Fix windows errors by optimizing your registry

Hello all,

Thanks for the valuable suggesions & reference,
I know it itches when some thing can not be done when it is part of
project...
As per me, till the level of RnD I have done also concludes that at
driver level there is only File READ / WRITE commands.
Where COPY can not be identyfied,

But, as per me, As for User, Where File Create & File Copy are two
different commands, there should be atlist one difference between the
two so as OS also can identify that what is Create & what is Copy.

If it is not at driver level then I / We need to search out as to what
level this can be identified & handeled.
And can this be intigrated with the driver level code / applicaiton or
not.

If any one has any knowhow over this ground then suggessions please.

As of till then I am stil in search of the ways how this can be worked
out.
If not on driver level then Where... & How ?

will keep on posting my end progress at here...

Bipin

On May 24, 9:17 am, "Maxim S. Shatskih" <ma...@xxxxxxxxxxxxxxxx>
wrote:
    At driver level, you cannot distinguish the copy from the new file
creation.

    The idea is futile.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
ma...@xxxxxxxxxxxxxxxxxxxx://www.storagecraft.com

"Bipin Mistry" <bpnmis...@xxxxxxxxx> wrote in message

news:6a3688db-4c57-4671-a27c-30043ef6aa32@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx



Hello,

How can I trace following System Copy commands and block them, so as
secured folder/drive do not react to these commands.

1. [Ctrl + C],
2. Right Click Menu -> Copy
3. File Menu -> Copy
4. Command prompt copy

As per me all above command will be calling a single rutine process at
driver level.
I am unable to identify which rutine dose it call & how can I identify
that the any of above 4 are triggered.

During my RnD till now I reached till IRP_MJ_READ & WRITE where by
related parameters and their properties do not describe about COPY in
specifically.

Some place I read about this can be posible with keeping watch on
Clipboard, dont know how much this will be useful, as there was no
extra informaiton was provided.

If any one can help me out for this situation then please do share
your knowledge with me.

Best regards,
Bipin- Hide quoted text -

- Show quoted text -

.

Relevant Pages

  • Re: How to block system copy commands at driver level
    ... environment is a problem how to limit sensitive information leak. ... If unapproved storage is accessible, there are other ways to move sensitive information there, other than copy. ... driver level there is only File READ / WRITE commands. ... If it is not at driver level then I / We need to search out as to what ...
    (microsoft.public.development.device.drivers)
  • Re: How to block system copy commands at driver level
    ... the token will prohibit writes to all other drives. ... we have been asked to do user based accessibility enhancement of ... If we can not make any work arround for "Copy" in driver level, ... driver level there is only File READ / WRITE commands. ...
    (microsoft.public.development.device.drivers)
  • Re: How to block system copy commands at driver level
    ... This file is an arkived by Client end technology. ... If we can not make any work arround for "Copy" in driver level, ... and selectively limit sensitive information movement. ... driver level there is only File READ / WRITE commands. ...
    (microsoft.public.development.device.drivers)
  • Re: How to block system copy commands at driver level
    ... chance as in trying to find a way to live until you are 300 years old. ... Thanks for the valuable suggesions & reference, ... driver level there is only File READ / WRITE commands. ... If it is not at driver level then I / We need to search out as to what ...
    (microsoft.public.development.device.drivers)
  • Re: How to block system copy commands at driver level
    ... it sends this data ot your filter. ... driver level there is only File READ / WRITE commands. ... Clipboard, dont know how much this will be useful, as there was no ...
    (microsoft.public.development.device.drivers)