Re: Logging Access to HDD

[Heiko Wundram <modelnine@modelnine.org>]

Am 19.04.2011 11:44, schrieb Sebastian Biedermann:
> I dont need to log every single byte, it would be enough to know which
> file is accessed by the domU inside its image.
> So when I use HVM I need to modify qemu and not the xen source?

Won't work: the outer layer only sees block accesses, and not "actual"
file accesses, so you're only able to log (if patching qemu) which
blocks of the virtualized hard disk of your Windows system are accessed.
You'd need to correlate this to additional data that's stored on the
disk itself to find out which file a block that's accessed by the system
belongs to.

Doing this kind of correlation from the outside is hard, and it should
be much easier to plug a device driver into Windows itself which
intercepts the filesystem calls in NTFS.sys (which implements the VFS
for NTFS accesses under windows) to retrieve the accessed files from the
system itself (namely at the layer which knows about the filesystem
structure of an NTFS filesystem, which qemu as hardware virtualizer does
not).

-- 
--- Heiko.