Modify IFS (ithsmdrv.sys) filter driver to block stub file extended attribute changes when not initiated by TSM

Within the IBM Tivoli Storage Manager HSM for Windows product, there exists a limitation which does not support Mac OS X clients (from OS X 10.6 onwards) to access NTFS v5 file systems which contain HSM stub files due to the manner by which Mac OS X ADS (Alternative Data Streams) cause corruption of stub files left by the HSM application.

Currently, under the following conditions, stub files created by the HSM client can silently lose their offline attribute:

If a file is migrated into an HSM file space and then recalled by a Mac client with ADS en-abled, the recall occurs successfully most of the time. If the Mac client then makes a change to the recalled file which adds metadata (particularly with Adobe products) and the file is re-migrated, the new stub file loses its offline attribute.

This loss of offline attribute is also possible if the ADS enabled Mac client adds additional meta-data to the stub file – i.e. the file is not recalled from HSM by the Mac client but additional streams have been previously added to the stub file.

The effect of the loss of offline attribute is manifested when the Tivoli Storage Manager Backup/Archive client parses the file system during scheduled incremental backup activity. The stub file appears to have changed (the loss of the offline attribute is seen as a change in state) and the stub file is therefore backed up. This process causes the stub file to become an active object which by extension makes the real file become inactive and subject to expiration via the retention period set for the files within its management class.

This introduces the risk of data loss if stub files which have lost their offline attribute are not identified.


The Request for Enhancement (RFE) revolves around changes to the IFS (ithsmdrv.sys) filter driver to allow it to prohibit changes to offline attributes of stub files unless these are made by the HSM client itself.

A filter driver is a special type of layered driver which attaches itself to any other driver and intercept requests directed at the lower driver's Device objects. It is developed primarily to allow the addition of new functionality beyond what is currently available. The filter driver may either use the services of the original target of the I/O request, or use the services of other kernel-mode drivers to provide value-added functionality.

In the case of the ithsmdrv.sys filter driver, the RFE describes the addition of a function to determine if a change to the offline extended attribute for stub files should be blocked unless they originate from the HSM for Windows client itself. This change would thus stop stub files from loosing their offline attribute when manipulated by Mac OS clients, hence resolving the problem described above and also bringing the HSM client to a status where it can safely support Mac OS clients accessing HSM enabled file systems and fully support Mac clients.

It has also been determined through contact with IBM Professional Services this is not part of the current roadmap for the IBM Tivoli Storage Manager for HSM product and we would like to have this changed urgently.