Well, oh well
The format for the image file used by ImDisk command line control program with the
-F switch or by the ImDisk driver in the registry setting
FileName0 is not that specific to ImDisk, it is called the
Windows NT Native Path format. It is the path format used internal by the Windows kernel, that is, the only path format that the kernel and other drivers will understand. It could look a bit tricky to use, especially because there are literally hundreds of ways to express the same path because of all kinds of virtual paths through symbolic link objects and other things that only exist for compatibility with older versions of Windows.
Example:
You have the path
C:\images\disk.img and you want to use that in the
FileName0 value in the ImDisk driver settings. The easiest thing is to just append
\??\ before the drive letter based path. This gives a perfectly valid native path.
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ImDisk\Parameters]
"FileName0"="\\??\\C:\\images\\disk.img"
"LoadDevices"=dword:00000001
If anyone want to investigate further what really happens, we must identify what
C: really points to. My dosdev utiltiy does that, or looking in the
\GLOBAL?? directoty with winobj will do the same.
C:\>dosdev -q C:
C: => \Device\HarddiskVolume1
This means that the registy file above could have been:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ImDisk\Parameters]
"FileName0"="\\Device\\HarddiskVolume1\\images\\disk.img"
"LoadDevices"=dword:00000001
\Device\HarddiskVolume1 is the real
device object for the disk volume, handled by the disk driver and given this particular name by the volume manager.
Now what about for example
\Device\Harddisk0\Partition1?
If you look at Windows NT 4.0 or earlier version, you will see that it works a little different.
C:\>dosdev -q C:
C: => \Device\Harddisk0\Partition1
There is no volume manager before Windows 2000, so the partition objects the disk drivers created where named like that, with the number of the harddisk (starting 0) and the number of the partition (starting 1). So, on Windows NT 4.0 you could use this syntax:
REGEDIT4
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ImDisk\Parameters]
"FileName0"="\\Device\\Harddisk0\\Partition1\\images\\disk.img"
"LoadDevices"=dword:00000001
But for compatibility reasons, the disk drivers today also create symbolic links called for example
\Device\Harddisk0\Partition1 pointing to for example
\Device\HarddiskVolume1 so that the old syntax could still be used to make old drivers compatible with newer versions of Windows (or just to make it easy to write software for both Windows NT 4.0 and Windows 2000).
It is easy to programmatically check what a symbolic link points to, but Windows provides no easy way to find all symbolic links pointing to a particular device object. This means that it is very easy to find out
\Device\HarddiskVolume1 given the path
\Device\Harddisk0\Partition1, but not very easy to know that
\Device\Harddisk0\Partition1 points to it given only the path
\Device\HarddiskVolume1. The only way is to work through all symbolic links on the system and check each one of them and that it pretty much what you do manually if you check with the winobj tool.
Hope this gave answeres to some of the questions in this thread.
