drvfs support for \\?\

[Hawk777]

Is your feature request related to a problem? Please describe.
I’m trying to mount a volume shadow copy in Linux. It’s annoying that I currently have to use an old copy of dosdev that I found lying around the Internet to give it a drive letter, then mount the drive letter in Linux.

Describe the solution you'd like
I would like to be able to run either mount -t drvfs '\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy15' /mnt/foo or mount -t drvfs '\\?\Volume{734851c5-4fc4-49f6-9632-7528f855a702}\' /mnt/foo in Linux. Other people presumably will have other uses for \\?\ unrelated to shadow copy.

[github-actions]

Logs are required for review from WSL team

If this a feature request, please reply with '/feature'. If this is a question, reply with '/question'.
Otherwise please attach logs by following the instructions below, your issue will not be reviewed unless they are added. These logs will help us understand what is going on in your machine.

How to collect WSL logs

Download and execute collect-wsl-logs.ps1 in an administrative powershell prompt:

Invoke-WebRequest -UseBasicParsing "https://raw.githubusercontent.com/microsoft/WSL/master/diagnostics/collect-wsl-logs.ps1" -OutFile collect-wsl-logs.ps1
Set-ExecutionPolicy Bypass -Scope Process -Force
.\collect-wsl-logs.ps1

The script will output the path of the log file once done.

If this is a networking issue, please use collect-networking-logs.ps1, following the instructions here

Once completed please upload the output files to this Github issue.

Click here for more info on logging
If you choose to email these logs instead of attaching to the bug, please send them to [email protected] with the number of the github issue in the subject, and in the message a link to your comment in the github issue and reply with '/emailed-logs'.

[Hawk777]

/feature

[github-actions]

Diagnostic information

Found '/feature', adding tag 'feature'

[OneBlue]

@Hawk777: The best way to achieve this would to use wsl --mount, which can mount a block device directly into WSL (drvfs only allows mounting of mount points inside WSL, not block devices).

[Hawk777]

@OneBlue That doesn’t seem to work:

PS C:\WINDOWS\system32> $obj


Caption            :
Description        :
InstallDate        : 2024-11-15 14:46:16
Name               :
Status             :
ClientAccessible   : True
Count              : 1
DeviceObject       : \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy4
Differential       : True
ExposedLocally     : False
ExposedName        :
ExposedPath        :
ExposedRemotely    : False
HardwareAssisted   : False
ID                 : {61704C0F-9317-45AC-BCFC-B8CABA7D7EFD}
Imported           : False
NoAutoRelease      : True
NotSurfaced        : False
NoWriters          : True
OriginatingMachine : <redacted>
Persistent         : True
Plex               : False
ProviderID         : {B5946137-7B9F-4925-AF80-51ABD60B20D5}
ServiceMachine     : <redacted>
SetID              : {48EF6CED-9205-4701-B617-163451192EB3}
State              : 12
Transportable      : False
VolumeName         : \\?\Volume{76692ca8-0000-0000-0000-10443a000000}\
PSComputerName     :



PS C:\WINDOWS\system32> wsl --mount "\\?\Volume{76692ca8-0000-0000-0000-10443a000000}\"
The system cannot find the path specified.
Error code: Wsl/Service/AttachDisk/ERROR_PATH_NOT_FOUND
PS C:\WINDOWS\system32> wsl --mount "\\?\Volume{76692ca8-0000-0000-0000-10443a000000}"
The process cannot access the file because it is being used by another process.
Error code: Wsl/Service/AttachDisk/ERROR_SHARING_VIOLATION
PS C:\WINDOWS\system32> wsl --mount "\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy4"
Incorrect function.
Error code: Wsl/Service/AttachDisk/0x80070001
PS C:\windows\system32> wsl --mount "\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy4\"
The media is write protected.
Error code: Wsl/Service/AttachDisk/HCS/0x80070013

Adding --name shadow, --type ntfs, --options ro, and or --bare don’t change anything; the same errors are shown.

I also tried creating a symlink to the shadow copy with mklink, only to end up with a symlink that works fine in Windows but is so broken in Linux that even readlink fails, never mind trying to actually navigate into it.

[OneBlue]

This command line look like the closest to actually work:

wsl --mount "\\?\Volume{76692ca8-0000-0000-0000-10443a000000}"
The process cannot access the file because it is being used by another process.

Is the device used anywhere else ? WSL needs exclusive access to mount it via wsl --mount

[Hawk777]

@OneBlue Here’s a complete transcript. I powered up, logged in to get a desktop, started an elevated powershell, and did this and nothing else:

Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

Try the new cross-platform PowerShell https://aka.ms/pscore6

PS C:\WINDOWS\system32> invoke-cimmethod -classname win32_shadowcopy -methodname create -arguments @{Volume="C:\"}

ReturnValue ShadowID                               PSComputerName
----------- --------                               --------------
          0 {1E44B691-B789-4969-9E89-9A9E3E4CCF91}


PS C:\WINDOWS\system32> get-ciminstance -classname win32_shadowcopy -filter "id='{1E44B691-B789-4969-9E89-9A9E3E4CCF91}'"


Caption            :
Description        :
InstallDate        : 2024-11-15 17:36:42
Name               :
Status             :
ClientAccessible   : True
Count              : 1
DeviceObject       : \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy6
Differential       : True
ExposedLocally     : False
ExposedName        :
ExposedPath        :
ExposedRemotely    : False
HardwareAssisted   : False
ID                 : {1E44B691-B789-4969-9E89-9A9E3E4CCF91}
Imported           : False
NoAutoRelease      : True
NotSurfaced        : False
NoWriters          : True
OriginatingMachine : kruskal.home.chead.ca
Persistent         : True
Plex               : False
ProviderID         : {B5946137-7B9F-4925-AF80-51ABD60B20D5}
ServiceMachine     : kruskal.home.chead.ca
SetID              : {E59DFF72-3054-4A94-AF05-96595CDB49E1}
State              : 12
Transportable      : False
VolumeName         : \\?\Volume{76692ca8-0000-0000-0000-10443a000000}\
PSComputerName     :



PS C:\WINDOWS\system32> wsl --mount "\\?\Volume{76692ca8-0000-0000-0000-10443a000000}" --name shadow
The process cannot access the file because it is being used by another process.
Error code: Wsl/Service/AttachDisk/ERROR_SHARING_VIOLATION

[Hawk777]

Oh, on further investigation, I see why that didn’t work: VolumeName isn’t the name of the shadow volume, it’s the name of the original volume, in this case C:\, which is obviously already mounted (and also not what I want to mount).

[Hawk777]

@OneBlue well I did find a workaround. WSL can’t follow a symlink to a \\?\GLOBALROOT path, nor can it mount such a path directly. SUBST also can’t give a driver letter to a \\?\GLOBALROOT path either. However, SUBST can give a drive letter to a symlink pointing at a \\?\GLOBALROOT path, and then WSL can mount the SUBSTed drive letter. So… works I guess? Inconsistencies galore, but given that even creating the symlink in the first place is really inconsistent (MKLINK works, New-Item -ItemType SymbolicLink doesn’t), perhaps WSL is just an acceptable addition to the list of things that don’t work with \\?\GLOBALROOT paths.