Diskmon Logo
Copyright © 1998 Mark Russinovich
Last Updated May 4, 1998 V1.0
Introduction Diskmon is a Windows NT device driver/GUI combination that together log and display all process activity on a Windows NT 4.0 system.
Installation and Use Installing Diskmon is as easy as unzipping it and typing, "diskmon." The GUI dynamically loads the driver (based on code from the instdrv sample in the Windows NT DDK), which begins monitoring all hard drives. The menus and toolbar buttons can be used to disable event capturing, control the scrolling of the listview, and to save the listview contents to an ASCII file.

Read and write offsets are presented in terms of sectors (512 bytes). Events can be either timed for their duration (in microseconds), or stamped with the absolute time that they were initiated. The History Depth dialog can be used to specify the maximum number of records that will be kept in the GUI (0 signifies no limit).

Sample Screenshot This is a screenshot of Diskmon watching hard disk activity.

Implementation

Using standard filtering techniques it is not possible for a dynamically loaded driver like Diskmon to attach to hard disk device objects and see requests originating in file systems.This is because file system drivers open disk devices during system initialization and, unlike the I/O Manager, file system drivers send IRPs directly at these devices. The I/O Manager allows for file system filter drivers to attach to file system devices after initialization because it checks for attached devices whenever it is going to send an Irp to a file system, and will direct the Irps to them instead.

Diskmon overcomes this limitation by using the technique I've developed of driver function interception. Diskmon locates a disk device's driver object and replaces the driver's dispatch entry points with its own. The Diskmon filter functions pass Irps it sees onto the hooked driver, and also intercepts completion routines in a similar way so that it can see the results of requests.
.

Download Diskmon (39KB)