谢谢指正。
磁盘加密功能太弱了，入侵一拷就拷走了。 文件系统层加上权限控制访问进程。但架不住 磁盘卷类设备 到文件系统之间，安插了其他驱动，绕过权限控制，还是可以拷走。 所以需要文件系统层做些加密
【 在 z16166 的大作中提到: 】
: 使用buffer咋会导致文件操作就不走文件系统了？表述肯定是有问题的。
: 是指Fast I/O？
: Fast I/O is specifically designed for rapid synchronous I/O on cached files. In fast I/O operations, data is transferred directly between user buffers and the system cache, bypassing the file system and the storage driver stack. (Storage drivers do not use fast I/O.) If all of the data to be read from a file is resident in the system cache when a fast I/O read or write request is received, the request is satisfied immediately. Otherwise, a page fault can occur, causing one or more IRPs to be generated. When this happens, the fast I/O routine either returns FALSE, or puts the caller into a wait state until the page fault is processed. If the fast I/O routine returns FALSE, the requested operation failed and the caller must create an IRP.
: ...................
--
FROM 115.220.204.*