Is there a way to directly query the file system device driver for listing out the files in a directory?

6
votes

I'm currently using FindFirstFile, FindNextFile API to recursively iterate through directories for searching files based on a given criteria. I noticed that "dir /s" command gives better performance than my program. I'm tried checking out the events in process monitor and it looks like cmd.exe/dir command is directly querying the disk device driver. Is there any way I can achieve some thing similar with DeviceIOControl() ?. I'm very new to device drivers though not new to programming. Attaching procmon output for reference:

alt text

Regards,

5
windowswinapifilesystemsdevice-driverdrivers
There is some caching going on in DIR /S – Robert Harvey
It's probably true (were you able to deduce it based on the screen shot attached ?) because I searched for the same "*.mp3" a couple of times. But it was fast even the first time. Also just to be sure I tried several random searches of files I haven't accessed for a while. It seems to be fast regard less. – ivymike
Also, Is there any hidden API called QueryDirectory() that is not exposed through standard libraries ?. I know ReadFile() is standard but wasn't able to find QueryDirectory() any where. – ivymike

5 Answers

3
votes

Use FindFirstFile and FindNextFile. That's the API, using DeviceIOControl directly is either a mess or not possible (don't know exactly).

Have you tried FindFirstFileEx and it's FIND_FIRST_EX_LARGE_FETCH flag and FindExInfoBasic info level?

2
votes

"dir /s" is using FindFirst/Next. It doesn't do any special magic to enumerate the files.

QueryDirectory appears to be how Procmon exposes what FindFirst/Next does to get its data from the file system.

1
votes

You can call ZwQueryDirectoryFile directly. Going further down to the driver level would require sending a bunch of IRPs and would probably be an overkill.

1
votes

http://ntfs-search.sourceforge.net/

It works well. And faster.
It opens a volume, and parses directly.

But it only works on NTFS.

1
votes

Profile your app, your bottleneck is likely to be elswhere. Some of these options are like taking out a shotgun to shoot a fly...

-scott