Edit

Filtering I/O Operations in a Minifilter Driver

  • Article

The following list describes several guidelines for filtering specific types of I/O operations in a file system minifilter driver:

  • The preoperation callback routine for IRP_MJ_CREATE cannot query or set contexts for files, streams, or stream handles, because, at pre-create time, the file or stream (if any) that is going to be created has not yet been determined.

  • The postoperation callback routine for IRP_MJ_CLOSE cannot set or query contexts for files, streams, or stream handles, because the system-internal structures that those items are associated with are freed before the post-close routine is called.

  • Minifilter drivers must never fail IRP_MJ_CLEANUP or IRP_MJ_CLOSE operations. These operations can be pended, returned to the filter manager, or completed with STATUS_SUCCESS. However, a preoperation callback routine must never fail these operations.

  • Minifilter drivers cannot register a postoperation callback routine for IRP_MJ_SHUTDOWN.