Accessing normalised path in Windows

I am working with logs that are generated by a kernel driver (Windows OS) which writes normalized path to logs. The normalized path for C:\Windows\System32\conhost.exe is \Device\HarddiskVolume3\Windows\System32\conhost.exe on my machine i.e. C: is \Device\HardiskVolume3.

Creating a Path out of a normalized path doesn't work e.g. following fails.

let p = PathBuf::from("\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe");
assert!(p.is_file()); // fails

Is there a crate in Rust that can help me here? I am thinking of maintaining a mapping between the device name and the drive letter and using it to rewrite paths. I was hoping that normalized path would just work! Apparently not. Even in the powershell.exe, I can't open them.


PS C:\Users\DELL> ls \Device\HarddiskVolume3\Windows\System32\conhost.exe
ls : Cannot find path 'C:\Device\HarddiskVolume3\Windows\System32\conhost.exe' because it does not exist.
At line:1 char:1
+ ls \Device\HarddiskVolume3\Windows\System32\conhost.exe
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (C:\Device\Hardd...m32\conhost.exe:String) [Get-ChildItem], ItemNotFound
   Exception
    + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetChildItemCommand

PS C:\Users\DELL> ls C:\Windows\System32\conhost.exe


    Directory: C:\Windows\System32


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----        10-11-2022     09:49        1028096 conhost.exe


PS C:\Users\DELL>

If you replace \Device\ with \\?\ it should work ?

- \Device\HarddiskVolume3\Windows\System32\
+ \\?\HarddiskVolume3\Windows\System32\

(shown without escaping)

On my machine this works:

let p = PathBuf::from("\\\\?\\HarddiskVolume3\\Windows\\System32\\conhost.exe");
assert!(p.is_file()); // passes

Reference

3 Likes