FVdriver2 is a virtual disk with journalling, like fvdriver. It differs in one way: the journal labels each write with PID, time, lbn, and size of write, so that the PID can be used to say in principle one can play back all writes except those done by some user, or perhaps all except those done in one login session. Only the PID is recorded, for reasons of speed and generality. It can happen that irp$l_pid is a system address, of course, in which case the PID is not readily available and may not exist at all. for normal use, however, when fvdriver points at a file on a real disk, the PID will usually be meaningful, with the aid of an accounting record.