[Diskmon Logo]

 Copyright © 1998 Mark Russinovich

 Last Updated May 4, 1998 V1.0
  ------------------------------------------------------------------------

     Introduction Diskmon is a Windows NT device driver/GUI combination
                  that together log and display all process activity on a
                  Windows NT 4.0 system.

     Installation Installing Diskmon is as easy as unzipping it and
          and Use typing, "diskmon." The GUI dynamically loads the driver
                  (based on code from the instdrv sample in the Windows
                  NT DDK), which begins monitoring all hard drives. The
                  menus and toolbar buttons can be used to disable event
                  capturing, control the scrolling of the listview, and
                  to save the listview contents to an ASCII file.

                  Read and write offsets are presented in terms of
                  sectors (512 bytes). Events can be either timed for
                  their duration (in microseconds), or stamped with the
                  absolute time that they were initiated. The History
                  Depth dialog can be used to specify the maximum number
                  of records that will be kept in the GUI (0 signifies no
                  limit).

           Sample This is a screenshot of Diskmon watching hard disk
       Screenshot activity.

  Implementation  Using standard filtering techniques it is not possible
                  for a dynamically loaded driver like Diskmon to attach
                  to hard disk device objects and see requests
                  originating in file systems.This is because file system
                  drivers open disk devices during system initialization
                  and, unlike the I/O Manager, file system drivers send
                  IRPs directly at these devices. The I/O Manager allows
                  for file system filter drivers to attach to file system
                  devices after initialization because it checks for
                  attached devices whenever it is going to send an Irp to
                  a file system, and will direct the Irps to them
                  instead.

                  Diskmon overcomes this limitation by using the
                  technique I've developed of driver function
                  interception. Diskmon locates a disk device's driver
                  object and replaces the driver's dispatch entry points
                  with its own. The Diskmon filter functions pass Irps it
                  sees onto the hooked driver, and also intercepts
                  completion routines in a similar way so that it can see
                  the results of requests.
                  .

  ------------------------------------------------------------------------

                          Download Diskmon (39KB)

                                  [Image]