Each I/O that is occurring within your system might transfer a large amount of data. For example, let's say an I/O is sent to read 128 sectors from the hard drive. Sectors typically store 512 bytes. That would mean that the system is attempting to read 512*128 bytes which is 64K. busTRACE can capture the entire data, if so configured.

You may find that you are not interested in storing the entire amount of data transferred with each I/O. Perhaps you are only interested in the first 16 bytes or no bytes at all. Perhaps you're only looking for error information and do not care about the data. Alternatively, if you're doing Data Corruption Analysis, you probably want to store all the data transferred so that you have it available for your analysis.

Simply enter in the maximum number of bytes you would like captured per I/O. The smaller the value, the more I/O activity busTRACE will be able to capture into memory (as less space would be used to store any data transferred). busTRACE defaults to storing up to the first 512 bytes of transfer in the capture buffer.

You can enter the data in hex format if you like. Simply append the data with 'h'. For example, to submit 256 decimal bytes as the value, in hex, you would enter 100h.

This feature is only available under Windows 2000 and above. This feature can only work if you have our Advanced Filtering feature enabled.

Windows storage port drivers (e.g. SCSIPORT.SYS, ATAPI.SYS, USBSTOR.SYS, etc.) can be sent two types of requests. One is a SCSI Request Block (SRB). SRBs allow another device driver to send down a request to a device. The other is a SCSI Pass Through IOCTL (SPTI). SCSI Pass Through IOCTLs are accessible to ring 3 applications that want to send down a CDB to a storage device. busPROBE, for example, uses SCSI Pass Through under Windows 2000 (and above) to send down CDBs.

When a port driver receives a SCSI Pass Through IRP, many will internally create an SRB IRP and send it to the device. The contents of the SRB IRP are usually identical to the SCSI Pass Through IRP. It is for this reason that busTRACE defaults to only showing you the SCSI Pass Through IRP.

If you place a checkmark on this option, busTRACE will attempt to capture any SRB IRPs that are being created in order to process the SCSI Pass Through IRP. Our ability to do this is dependent on the port driver.

As an example, consider this screenshot:

In this sample, we have enabled busTRACE's Viewing Interleaved I/O Activity feature. This sample capture is for a single Inquiry CDB being sent to a DVD recorder. There are four entries in the sample above; each one described below.

1. The first line shows an SPTI request (IOCTL_SCSI_PASS_THROUGH_DIRECT) with an Inquiry command embedded within the structure.
2. The SPTI request is received by Microsoft's ATAPI.SYS driver. In order to process the IOCTL, ATAPI.SYS internally creates an SRB IRP.
3. The SRB IRP has now finished. Here, you can see that the overall time for the SRB IRP was 366 usec.
4. Now that ATAPI.SYS has the SRB IRP finished, it has the information necessary to complete the initial SPTI request. Here, you can see that the overall time for the SPTI IRP to finish was 383 usec.

By enabling this option, you are requesting busTRACE to take a snapshot of an outbound data buffer (e.g. Write CDB) when the I/O starts (i.e. going down the I/O stack) as well as when the I/O finishes (i.e. going back up the I/O stack). This feature can be useful to help determine if some software is altering the buffer in the middle of a write sequence. When this feature is enabled, and you perform a data corruption analysis, busTRACE will automatically compare both buffers and flag the I/O with a bookmark and comment if the buffers do not match. The comment will state "Buffer altered during write sequence." In the Raw Data pane, you can use the "Split Vertical View" or "Split Horizontal View" toolbar button to have both buffers appear at the same time.