Hi,
I am totally new to Windows Internals and request you to bear with my
question(s).
Assumptions/Observations:
I used a utility Filemon available at
www.sysinternals.com to see how the
files are accessed, and observerd that the intra-file accesses are
sequential in nature.
I observe that the application requests the data from the file in such
manner as shown by the last column where we can see the offset and the
length that is read (requested by the application which requested the read).
This length, I believe is what the application requested (and then requested
many times over to read the file).
Questions:
1. Is this length broken-up by Windows (Cache Manager?) to finer/fixed sizes
and obtained from the file?
2. If that size is fixed, what is it?
3. If not fixed, is it calculated dynamically, and how?
Pasted below, is a part of data collected using filemon.
I would appreciate any feedback on above.
Thanks and regards,
Kunal Gandhi
432 6:25:45 PM System:8 IRP_MJ_WRITE* C:\pagefile.sys SUCCESS Offset:
56483840 Length: 65536
433 6:25:45 PM System:8 IRP_MJ_WRITE* C:\pagefile.sys SUCCESS Offset:
56549376 Length: 65536
434 6:25:45 PM System:8 IRP_MJ_WRITE* C: SUCCESS Offset: 10563584 Length:
4096
435 6:25:45 PM System:8 IRP_MJ_WRITE* C: SUCCESS Offset: 25567232 Length:
16384
436 6:25:45 PM System:8 IRP_MJ_WRITE* C: SUCCESS Offset: 12288 Length: 4096
437 6:25:45 PM System:8 IRP_MJ_WRITE* C: SUCCESS Offset: 14655488 Length:
4096
438 6:25:45 PM System:8 IRP_MJ_WRITE* C: SUCCESS Offset: 15609856 Length:
4096
439 6:25:45 PM System:8 IRP_MJ_WRITE* C: SUCCESS Offset: 56442880 Length:
4096
440 6:25:45 PM System:8 IRP_MJ_WRITE* C: SUCCESS Offset: 59117568 Length:
16384
441 6:25:45 PM System:8 IRP_MJ_WRITE* C: SUCCESS Offset: 61124608 Length:
8192
442 6:25:45 PM System:8 IRP_MJ_WRITE* C: SUCCESS Offset: 62820352 Length:
4096
443 6:25:45 PM System:8 IRP_MJ_WRITE* C: SUCCESS Offset: 63012864 Length:
8192
444 6:25:45 PM System:8 IRP_MJ_WRITE* C: SUCCESS Offset: 63164416 Length:
8192
445 6:25:45 PM System:8 IRP_MJ_WRITE* C: SUCCESS Offset: 64106496 Length:
4096
446 6:25:45 PM System:8 IRP_MJ_WRITE* C: SUCCESS Offset: 28672 Length: 4096
447 6:25:45 PM System:8 IRP_MJ_WRITE* C: SUCCESS Offset: 430080 Length: 4096
448 6:25:45 PM System:8 IRP_MJ_WRITE* C: SUCCESS Offset: 462848 Length: 4096
449 6:25:45 PM System:8 IRP_MJ_WRITE* C: SUCCESS Offset: 487424 Length: 4096
450 6:25:45 PM System:8 IRP_MJ_WRITE* C: SUCCESS Offset: 2768896 Length:
4096
451 6:25:45 PM System:8 IRP_MJ_WRITE* C: SUCCESS Offset: 2850816 Length:
4096
452 6:25:45 PM System:8 IRP_MJ_WRITE* C: SUCCESS Offset: 4423680 Length:
4096
453 6:25:45 PM System:8 IRP_MJ_WRITE* C: SUCCESS Offset: 4739072 Length:
4096
454 6:25:45 PM System:8 IRP_MJ_WRITE* C: SUCCESS Offset: 6225920 Length:
4096
455 6:25:45 PM System:8 IRP_MJ_WRITE* C: SUCCESS Offset: 6967296 Length:
4096
456 6:25:45 PM System:8 IRP_MJ_WRITE* C: SUCCESS Offset: 7659520 Length:
4096
Similar Threads
