{"users":[{"id":7649,"username":"Paul_Jackson","name":"Paul_Jackson","avatar_template":"/letter_avatar_proxy/v4/letter/p/b5a626/{size}.png","trust_level":2},{"id":644,"username":"Scott_Noone_OSR","name":"Scott Noone","avatar_template":"/letter_avatar_proxy/v4/letter/s/e19b73/{size}.png","admin":true,"trust_level":4},{"id":8405,"username":"benji","name":"benji","avatar_template":"/letter_avatar_proxy/v4/letter/b/f17d59/{size}.png","trust_level":2},{"id":11639,"username":"tguichaoua","name":"","avatar_template":"/user_avatar/community.osr.com/tguichaoua/{size}/1037_2.png","trust_level":1},{"id":7446,"username":"Zac_Lockard","name":"Zac_Lockard","avatar_template":"/letter_avatar_proxy/v4/letter/z/47e85d/{size}.png","trust_level":2},{"id":-1,"username":"system","name":"system","avatar_template":"/user_avatar/community.osr.com/system/{size}/735_2.png","admin":true,"moderator":true,"trust_level":4},{"id":11558,"username":"tegat","name":null,"avatar_template":"/letter_avatar_proxy/v4/letter/t/f6c823/{size}.png","trust_level":1},{"id":75,"username":"Bo_Branten","name":"Bo_Brantén","avatar_template":"/letter_avatar_proxy/v4/letter/b/e47c2d/{size}.png","trust_level":2},{"id":6862,"username":"Olof_Lagerkvist","name":"Olof_Lagerkvist","avatar_template":"/user_avatar/community.osr.com/olof_lagerkvist/{size}/271_2.png","trust_level":1},{"id":3544,"username":"Fernando_Roberto","name":"Fernando_DriverEntry","avatar_template":"/user_avatar/community.osr.com/fernando_roberto/{size}/238_2.png","trust_level":2},{"id":11450,"username":"Aditya","name":"Aditya Borah","avatar_template":"/letter_avatar_proxy/v4/letter/a/df705f/{size}.png","trust_level":1},{"id":9398,"username":"brad_H","name":"brad_H","avatar_template":"/letter_avatar_proxy/v4/letter/b/3ec8ea/{size}.png","trust_level":2},{"id":6433,"username":"Dejan_Maksimovic","name":"Dejan_Maksimovic","avatar_template":"/letter_avatar_proxy/v4/letter/d/8baadc/{size}.png","trust_level":2},{"id":2683,"username":"rod_widdowson","name":"rod_widdowson","avatar_template":"/user_avatar/community.osr.com/rod_widdowson/{size}/233_2.png","trust_level":2},{"id":6292,"username":"Alnoor_Allidina","name":"Alnoor","avatar_template":"/user_avatar/community.osr.com/alnoor_allidina/{size}/24_2.png","trust_level":2},{"id":8667,"username":"MBond2","name":"MBond2","avatar_template":"/letter_avatar_proxy/v4/letter/m/46a35a/{size}.png","trust_level":2},{"id":11564,"username":"NewHere","name":"John Doe","avatar_template":"/letter_avatar_proxy/v4/letter/n/5e9695/{size}.png","trust_level":0},{"id":9211,"username":"DymOK93","name":"DymOK93","avatar_template":"/letter_avatar_proxy/v4/letter/d/f1d935/{size}.png","trust_level":2},{"id":86,"username":"Mark_Roddy","name":"Mark_Roddy","avatar_template":"/letter_avatar_proxy/v4/letter/m/439d5e/{size}.png","trust_level":2},{"id":10889,"username":"0mWindyBug","name":"0mWindyBug","avatar_template":"/letter_avatar_proxy/v4/letter/0/a9adbd/{size}.png","trust_level":2},{"id":11351,"username":"Ritesh","name":"RGP","avatar_template":"/letter_avatar_proxy/v4/letter/r/4af34b/{size}.png","trust_level":1},{"id":10430,"username":"chuckchopp","name":"chuckchopp","avatar_template":"/letter_avatar_proxy/v4/letter/c/0ea827/{size}.png","trust_level":2},{"id":11522,"username":"palgandharv27","name":"gp_quanta_76","avatar_template":"/letter_avatar_proxy/v4/letter/p/f4b2a3/{size}.png","trust_level":0},{"id":6947,"username":"Aleh_Kazakevich","name":"Aleh_Kazakevich","avatar_template":"/user_avatar/community.osr.com/aleh_kazakevich/{size}/891_2.png","trust_level":2},{"id":11471,"username":"coderall2","name":"a'lan","avatar_template":"/letter_avatar_proxy/v4/letter/c/f08c70/{size}.png","trust_level":0},{"id":10866,"username":"Fxtack","name":"Fxtack","avatar_template":"/letter_avatar_proxy/v4/letter/f/ecccb3/{size}.png","trust_level":1},{"id":11489,"username":"kursor","name":"karenbrewerr","avatar_template":"/letter_avatar_proxy/v4/letter/k/3ab097/{size}.png","trust_level":0},{"id":11487,"username":"Jack1","name":"Jack","avatar_template":"/letter_avatar_proxy/v4/letter/j/2bfe46/{size}.png","trust_level":1},{"id":10049,"username":"apmattil","name":"apmattil","avatar_template":"/letter_avatar_proxy/v4/letter/a/f17d59/{size}.png","trust_level":2},{"id":6169,"username":"Keiko_Chou","name":"Keiko_Chou","avatar_template":"/letter_avatar_proxy/v4/letter/k/ccd318/{size}.png","trust_level":1},{"id":11439,"username":"nbyaman","name":null,"avatar_template":"/letter_avatar_proxy/v4/letter/n/ce73a5/{size}.png","trust_level":1},{"id":11454,"username":"Seraj","name":null,"avatar_template":"/letter_avatar_proxy/v4/letter/s/ed8c4c/{size}.png","trust_level":0},{"id":11457,"username":"zziss","name":"","avatar_template":"/letter_avatar_proxy/v4/letter/z/e8c25b/{size}.png","trust_level":1},{"id":6373,"username":"Slava_Imameev","name":"Slava_Imameev","avatar_template":"/user_avatar/community.osr.com/slava_imameev/{size}/262_2.png","trust_level":2}],"primary_groups":[],"flair_groups":[],"topic_list":{"can_create_topic":false,"more_topics_url":"/c/ntfsd/6?page=1","per_page":30,"top_tags":[],"topics":[{"fancy_title":"ECP lifecycle, reparse, and driver unload","id":60174,"title":"ECP lifecycle, reparse, and driver unload","slug":"ecp-lifecycle-reparse-and-driver-unload","posts_count":4,"reply_count":1,"highest_post_number":4,"image_url":null,"created_at":"2026-07-13T09:16:24.669Z","last_posted_at":"2026-07-13T15:18:01.498Z","bumped":true,"bumped_at":"2026-07-13T15:18:01.498Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hello friends! \nI'm using FltAllocateExtraCreateParameter in a kernel mini filter driver. Then I attach it to a file. What happens if my driver is unloaded after that? What happens with the cleanup routine? If the driver…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":42,"like_count":2,"has_summary":false,"last_poster_username":"Scott_Noone_OSR","category_id":6,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":7649,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":644,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"System hang, many thread stalled in CcCanIWrite","id":60105,"title":"System hang, many thread stalled in CcCanIWrite","slug":"system-hang-many-thread-stalled-in-cccaniwrite","posts_count":6,"reply_count":2,"highest_post_number":6,"image_url":null,"created_at":"2026-04-13T08:13:08.177Z","last_posted_at":"2026-05-04T13:09:39.554Z","bumped":true,"bumped_at":"2026-05-04T13:09:39.554Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hello, \nI have a computer, where many applications are freezing. I asked the user to take a full memory dump. \nInside the dump, I can see that many threads are stalled in CcCanIWrite. I ran !defwrites, here is the ouput …","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":118,"like_count":0,"has_summary":false,"last_poster_username":"Scott_Noone_OSR","category_id":6,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":8405,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":644,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"How to create an INF file for a minfilter that works for different versions of Windows?","id":60083,"title":"How to create an INF file for a minfilter that works for different versions of Windows?","slug":"how-to-create-an-inf-file-for-a-minfilter-that-works-for-different-versions-of-windows","posts_count":10,"reply_count":5,"highest_post_number":10,"image_url":null,"created_at":"2026-03-25T09:46:33.471Z","last_posted_at":"2026-07-01T07:45:17.216Z","bumped":true,"bumped_at":"2026-04-02T07:44:32.347Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"I’m trying to create a minifilter and now I want to create an INF to install it. For that I base mine on the Minispy’s one. But when I run InfVerif on it, it fail to pass (note that I replace instances of $ARCH$ with arm…","visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":163,"like_count":3,"has_summary":false,"last_poster_username":"system","category_id":6,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":11639,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":644,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":7446,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Am I missing operatons I should be filtering in my mini filter?","id":59877,"title":"Am I missing operatons I should be filtering in my mini filter?","slug":"am-i-missing-operatons-i-should-be-filtering-in-my-mini-filter","posts_count":6,"reply_count":0,"highest_post_number":6,"image_url":null,"created_at":"2025-10-21T18:48:04.363Z","last_posted_at":"2026-03-31T02:06:52.074Z","bumped":true,"bumped_at":"2026-03-31T02:06:52.074Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"I have read many posts and articles from this site and it has helped me tremendously. \nI am a new mini filter (mf) developer writing a mf driver which filters requests to read or write files within specific folders on no…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":133,"like_count":0,"has_summary":false,"last_poster_username":"tegat","category_id":6,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"posters":[{"extras":"latest","description":"Original Poster, Most Recent Poster","user_id":11558,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":644,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Is mounting a filesystem inevitable in Windows?","id":60028,"title":"Is mounting a filesystem inevitable in Windows?","slug":"is-mounting-a-filesystem-inevitable-in-windows","posts_count":4,"reply_count":0,"highest_post_number":4,"image_url":null,"created_at":"2026-02-11T13:14:45.975Z","last_posted_at":"2026-05-13T12:28:14.239Z","bumped":true,"bumped_at":"2026-02-12T12:28:05.096Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hello, I maintain a filesystem driver for Windows and I just noticed a behavior that I wasn’t aware of: \nFirst, In the UNIX world we are used to the fact that if a user does not mount a partition then that filesystem wil…","visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":134,"like_count":1,"has_summary":false,"last_poster_username":"system","category_id":6,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":75,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":644,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":6862,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Is FastIoDispatch pointer required in a legacy filter?","id":60029,"title":"Is FastIoDispatch pointer required in a legacy filter?","slug":"is-fastiodispatch-pointer-required-in-a-legacy-filter","posts_count":3,"reply_count":0,"highest_post_number":3,"image_url":null,"created_at":"2026-02-11T13:44:39.005Z","last_posted_at":"2026-05-12T13:55:48.019Z","bumped":true,"bumped_at":"2026-02-11T13:54:46.142Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hi everyone. \nI’ve been looking at a crash dump from a customer who has his own legacy file system filter. The crash happens inside IopWriteFile when I/O Manager tries to get the FastIoWrite function pointer from DriverO…","visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":75,"like_count":1,"has_summary":false,"last_poster_username":"system","category_id":6,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":3544,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":644,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Disconnect and remap a network volume to the same local drive letter (for example, D:), the drive label continues to display the disconnected volume in Windows explorer UI","id":59986,"title":"Disconnect and remap a network volume to the same local drive letter (for example, D:), the drive label continues to display the disconnected volume in Windows explorer UI","slug":"disconnect-and-remap-a-network-volume-to-the-same-local-drive-letter-for-example-d-the-drive-label-continues-to-display-the-disconnected-volume-in-windows-explorer-ui","posts_count":2,"reply_count":0,"highest_post_number":2,"image_url":"https://community.osr.com/uploads/db2714/original/1X/21c44f97b77c499f731e378af88267844a3fef41.png","created_at":"2026-01-15T08:26:15.774Z","last_posted_at":"2026-04-15T08:26:43.111Z","bumped":true,"bumped_at":"2026-01-15T08:26:15.931Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hello All, \nWe are getting the following problem and request you to share your suggestions, comments. Thank you very much \nProblem: \nWhen a user disconnects an existing network volume (for eg: [\\\\server\\\\VOL_1](file://se…","visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":63,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":6,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":11450,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Legacy file system filter driver causing our minifilter’s IRP_MJ_QUERY_OPEN callback to not get called","id":59980,"title":"Legacy file system filter driver causing our minifilter's IRP_MJ_QUERY_OPEN callback to not get called","slug":"legacy-file-system-filter-driver-causing-our-minifilters-irp-mj-query-open-callback-to-not-get-called","posts_count":2,"reply_count":0,"highest_post_number":2,"image_url":null,"created_at":"2026-01-07T05:57:40.264Z","last_posted_at":"2026-04-07T05:57:56.608Z","bumped":true,"bumped_at":"2026-01-07T06:49:39.612Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"We have a legacy file system filter driver for very specific operations which are not possible with minifilters (this is out of topic). \nThe problem is, when this legacy filter driver is loaded, and hence attached to rel…","visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":73,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":6,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":9398,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"File/IoFE leaks","id":59917,"title":"File/IoFE leaks","slug":"file-iofe-leaks","posts_count":11,"reply_count":4,"highest_post_number":11,"image_url":null,"created_at":"2025-11-14T12:44:40.986Z","last_posted_at":"2026-03-01T16:50:31.204Z","bumped":true,"bumped_at":"2025-12-01T16:49:38.364Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"On a specific build of Win 11 (and not on later ones), I see a lot of leaks from File/IoFE. \nUsual Verifier pool tracking does not work (driver cannot be unloaded and also … it would track too much and thus be useless). …","visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":146,"like_count":3,"has_summary":false,"last_poster_username":"system","category_id":6,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":6433,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":2683,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":6292,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":644,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"24H2 BSOD With Error “MEMORY_MANAGEMENT (1a)”","id":59879,"title":"24H2 BSOD With Error “MEMORY_MANAGEMENT (1a)”","slug":"24h2-bsod-with-error-memory-management-1a","posts_count":26,"reply_count":22,"highest_post_number":28,"image_url":null,"created_at":"2025-10-22T09:16:28.794Z","last_posted_at":"2026-02-25T10:16:17.106Z","bumped":true,"bumped_at":"2025-11-27T10:16:14.695Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hello All, \nWe have upgraded to Windows 11 24H2, and now our custom drivers consistently causes a BSOD with the error code "MEMORY_MANAGEMENT (1a)". \nBUGCHECK_CODE:  1a \nBUGCHECK_P1: 8840 \nBUGCHECK_P2: ffffc4000e8c8c60 \nB…","visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":595,"like_count":2,"has_summary":false,"last_poster_username":"system","category_id":6,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":11450,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":8667,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":644,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"FltAddOpenReparseEntry usage example","id":59935,"title":"FltAddOpenReparseEntry usage example","slug":"fltaddopenreparseentry-usage-example","posts_count":4,"reply_count":0,"highest_post_number":4,"image_url":null,"created_at":"2025-11-25T12:29:02.885Z","last_posted_at":"2026-02-23T19:52:40.146Z","bumped":true,"bumped_at":"2025-11-25T19:52:26.121Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hello friends, \nI’m developing a minifilter driver that redirects file access on one drive to a folder on another drive. For example, each access to E:\\file will be redirected to C:\\redirection\\file_guid. \nI started with…","visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":67,"like_count":1,"has_summary":false,"last_poster_username":"system","category_id":6,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":7649,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":644,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Opening page file from disk filter (STATUS_SHARING_VIOLATION )","id":59892,"title":"Opening page file from disk filter (STATUS_SHARING_VIOLATION )","slug":"opening-page-file-from-disk-filter-status-sharing-violation","posts_count":6,"reply_count":2,"highest_post_number":6,"image_url":null,"created_at":"2025-10-24T17:23:15.027Z","last_posted_at":"2026-01-27T15:51:16.058Z","bumped":true,"bumped_at":"2025-10-29T15:51:01.669Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hey guys, I'm trying to intercept I/O operations, but I want to exclude paging operations because every time I intercept I get a BSOD with MEMORY_MANAGEMENT. I've tried checking IRP_PAGING_IO, SL_PAGING_IO, and FO_PAGING…","visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":121,"like_count":1,"has_summary":false,"last_poster_username":"system","category_id":6,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":11564,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":9211,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":86,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":644,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Minifilter design best practice","id":59874,"title":"Minifilter design best practice","slug":"minifilter-design-best-practice","posts_count":2,"reply_count":0,"highest_post_number":2,"image_url":null,"created_at":"2025-10-18T22:23:20.475Z","last_posted_at":"2026-01-16T22:24:04.962Z","bumped":true,"bumped_at":"2025-10-18T22:23:20.613Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hey! \nWe are writing a minifilter driver, and I’m the dev responsible to implement the first filtering logic in it. I could just register my filtering logic as the pre / post op callback for the said IRP but then it’d be…","visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":99,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":6,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":10889,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Close, cleanup callback not getting triggered","id":59855,"title":"Close, cleanup callback not getting triggered","slug":"close-cleanup-callback-not-getting-triggered","posts_count":3,"reply_count":0,"highest_post_number":3,"image_url":null,"created_at":"2025-09-28T17:56:45.013Z","last_posted_at":"2025-12-28T14:28:59.409Z","bumped":true,"bumped_at":"2025-09-29T14:28:14.139Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hi Everyone, \nI’ve developed a mini-filter driver that intercepts a sequence of callbacks including create, read, write, and close. I’m trying to perform certain operations during the close callback, and those operations…","visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":77,"like_count":2,"has_summary":false,"last_poster_username":"system","category_id":6,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":11351,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":644,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Minifilter intercepting request from perticular folder only","id":59853,"title":"Minifilter intercepting request from perticular folder only","slug":"minifilter-intercepting-request-from-perticular-folder-only","posts_count":4,"reply_count":0,"highest_post_number":4,"image_url":null,"created_at":"2025-09-25T11:39:50.388Z","last_posted_at":"2025-12-27T17:46:39.753Z","bumped":true,"bumped_at":"2025-09-28T17:45:48.538Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hello everyone, \nI’m trying to find a way to intercept I/O requests that originate from a specific folder using a minifilter driver. I understand that attaching the minifilter to the volume containing that folder works, …","visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":114,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":6,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":11351,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":644,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"How to disable the Op-Lock while opening a Windows File using CreateFile","id":59845,"title":"How to disable the Op-Lock while opening a Windows File using CreateFile","slug":"how-to-disable-the-op-lock-while-opening-a-windows-file-using-createfile","posts_count":11,"reply_count":7,"highest_post_number":11,"image_url":null,"created_at":"2025-09-09T16:30:09.146Z","last_posted_at":"2025-12-13T15:12:42.806Z","bumped":true,"bumped_at":"2025-09-14T15:12:10.493Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hello All, \nWe are opening a network file on Windows using the CreateFile API. According to MSDN, the flags FILE_FLAG_NO_BUFFERING and FILE_FLAG_WRITE_THROUGH should bypass local caching and write directly to disk. Howev…","visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":289,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":6,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":11450,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":644,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":8667,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Minifilter file size query","id":59825,"title":"Minifilter file size query","slug":"minifilter-file-size-query","posts_count":3,"reply_count":0,"highest_post_number":3,"image_url":null,"created_at":"2025-08-23T18:27:25.968Z","last_posted_at":"2025-11-22T11:22:50.974Z","bumped":true,"bumped_at":"2025-08-24T11:22:48.151Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hi, thanks for checking out my post. I have two questions related to minifilter driver behavior during write operations: \n\n\nIn a NonCached I/O operation where the PagingIo flag is false, will the value of Data->Iopb->Par…","visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":92,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":6,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":11351,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":2683,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Driver Signing - Manual Review for x64 build while ARM64 build gets signed immediately","id":59812,"title":"Driver Signing - Manual Review for x64 build while ARM64 build gets signed immediately","slug":"driver-signing-manual-review-for-x64-build-while-arm64-build-gets-signed-immediately","posts_count":7,"reply_count":1,"highest_post_number":7,"image_url":null,"created_at":"2025-08-14T17:11:40.120Z","last_posted_at":"2025-11-12T20:30:00.423Z","bumped":true,"bumped_at":"2025-08-14T20:29:25.103Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"I have a file system mini-filter driver which gets built for both x64 & ARM64 and is then run through HLK testing in a VM lab where "HLKSetup - 24H2 (Updated July 2025)" is installed on one VM as the controller and on 3 …","visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":141,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":6,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":10430,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":644,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Getting Warning in Event Viewer (File System Filter ‘xyz’ does not support bypass IO.)","id":59811,"title":"Getting Warning in Event Viewer (File System Filter 'xyz' does not support bypass IO.)","slug":"getting-warning-in-event-viewer-file-system-filter-xyz-does-not-support-bypass-io","posts_count":3,"reply_count":0,"highest_post_number":3,"image_url":null,"created_at":"2025-08-14T06:08:06.550Z","last_posted_at":"2025-11-12T15:20:28.690Z","bumped":true,"bumped_at":"2025-08-14T15:19:47.091Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hi Everyone, \nI maintain an older file system filter driver on Windows 11 where I'm encountering the following warning in the System log of Event Viewer: \nFile System Filter xyz does not support Bypass IO.\n\nThis log entr…","visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":695,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":6,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":11522,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":644,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Minifilter and observable order of requests completed by file system","id":59780,"title":"Minifilter and observable order of requests completed by file system","slug":"minifilter-and-observable-order-of-requests-completed-by-file-system","posts_count":3,"reply_count":0,"highest_post_number":3,"image_url":null,"created_at":"2025-07-22T18:14:19.104Z","last_posted_at":"2025-10-20T22:00:58.523Z","bumped":true,"bumped_at":"2025-07-22T22:00:13.681Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hi! \nI work on transparent file encryption (minifilter-based). A lot of time and effort was spend... \nAt now, I am struggling with one critical architectural problem and, in my opinion, the topic has been never discussed…","visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":112,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":6,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":6947,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":9211,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Weird CreateFile API Behavior which locked the directory","id":59705,"title":"Weird CreateFile API Behavior which locked the directory","slug":"weird-createfile-api-behavior-which-locked-the-directory","posts_count":5,"reply_count":1,"highest_post_number":5,"image_url":null,"created_at":"2025-06-06T02:43:39.198Z","last_posted_at":"2025-09-29T06:33:23.019Z","bumped":true,"bumped_at":"2025-07-01T06:32:38.122Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hi, we now use a Nodejs lib named chokidar to monitor our local directory's change. But we found it locked the parent and parent of the parent directory and ... of monitored-dir, which led to the failure to rename or del…","visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":157,"like_count":1,"has_summary":false,"last_poster_username":"system","category_id":6,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":11471,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":6292,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"System lagging when my filter driver attaches to C:","id":59742,"title":"System lagging when my filter driver attaches to C:","slug":"system-lagging-when-my-filter-driver-attaches-to-c","posts_count":5,"reply_count":1,"highest_post_number":5,"image_url":null,"created_at":"2025-06-27T04:53:20.230Z","last_posted_at":"2025-09-28T14:25:42.285Z","bumped":true,"bumped_at":"2025-06-30T14:25:38.008Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"I have written a minifilter driver to implement Policy-Based Access Control (PBAC) for the file system. Currently, my implementation is very simple. Below is the situation of my driver implementation: \n\nThe PBAC driver a…","visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":144,"like_count":2,"has_summary":false,"last_poster_username":"system","category_id":6,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":10866,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":6292,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":11489,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":644,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Windows HLK 24H2 (updated May 2025) - Installable File System Filter Test","id":59737,"title":"Windows HLK 24H2 (updated May 2025) - Installable File System Filter Test","slug":"windows-hlk-24h2-updated-may-2025-installable-file-system-filter-test","posts_count":6,"reply_count":1,"highest_post_number":6,"image_url":null,"created_at":"2025-06-25T18:46:24.374Z","last_posted_at":"2025-09-25T13:54:16.211Z","bumped":true,"bumped_at":"2025-06-27T13:53:20.313Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"In the Windows HLK 24H2 (updated May 2025), the test "Installable File System Filter Test" is failing on Windows Server 2025 24H2.  The following is present in the .wtl file regarding the failure: \nError 6/24/2025 10:21:…","visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":220,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":6,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":10430,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":644,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Manage increased file size","id":59735,"title":"Manage increased file size","slug":"manage-increased-file-size","posts_count":2,"reply_count":0,"highest_post_number":2,"image_url":null,"created_at":"2025-06-24T07:13:22.086Z","last_posted_at":"2025-09-22T07:13:47.217Z","bumped":true,"bumped_at":"2025-06-24T07:13:22.158Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hi Everyone, \nI am developing a minifilter driver which encrypt and decrypt files on fly. When i save txt file i receive a sector aligned buffer in my prewrite function with nocache io flag set. Basically iopb->Parameter…","visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":51,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":6,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":11487,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Mini-filter driver / .inf / DIRID 13 / install & uninstall","id":59707,"title":"Mini-filter driver / .inf / DIRID 13 / install & uninstall","slug":"mini-filter-driver-inf-dirid-13-install-uninstall","posts_count":13,"reply_count":1,"highest_post_number":13,"image_url":null,"created_at":"2025-06-09T15:50:44.282Z","last_posted_at":"2025-09-21T18:22:31.769Z","bumped":true,"bumped_at":"2025-06-23T18:22:29.271Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"For the file system mini-filter driver project that I'm currently working on, the .inf file has finally been populated to support both x64 & ARM64, and is using DIRID 13 (Driver Store) as the destination.  Building the d…","visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":532,"like_count":1,"has_summary":false,"last_poster_username":"system","category_id":6,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":10430,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":10049,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":86,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":7446,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"[DefaultInstall] decorated with architecture + OS version","id":59725,"title":"[DefaultInstall] decorated with architecture + OS version","slug":"defaultinstall-decorated-with-architecture-os-version","posts_count":8,"reply_count":1,"highest_post_number":8,"image_url":null,"created_at":"2025-06-18T20:56:06.639Z","last_posted_at":"2025-09-18T19:27:40.361Z","bumped":true,"bumped_at":"2025-06-20T19:27:02.015Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"According to the "MiniSpy" sample driver project's .inf file: \n\n\nIt is possible to decorate the [DefaultInstall] section with both the architecture and the OS version.  This is ostensibly being done to handle how the reg…","visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":306,"like_count":1,"has_summary":false,"last_poster_username":"system","category_id":6,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":10430,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":7446,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Is `PnpLockdown = 1` mandatory for minifilterdriver signing?","id":59652,"title":"Is `PnpLockdown = 1` mandatory for minifilterdriver signing?","slug":"is-pnplockdown-1-mandatory-for-minifilterdriver-signing","posts_count":7,"reply_count":2,"highest_post_number":7,"image_url":null,"created_at":"2025-05-16T10:38:52.212Z","last_posted_at":"2025-09-17T18:43:01.715Z","bumped":true,"bumped_at":"2025-06-19T18:42:37.207Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hi All, \nI may have missed something, but is specifying PnpLockdown=1 now mandatory for signing a minifilter driver? I started seeing the error message since May 13rd but never saw this before. \nError 1324 in xxx.Inf, li…","visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":492,"like_count":2,"has_summary":false,"last_poster_username":"system","category_id":6,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":6169,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":6433,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":644,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":7446,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Choosing Between Adaptive Radix Trie and PREFIX_TABLE for Storing File Paths in a Minifilter Driver","id":59708,"title":"Choosing Between Adaptive Radix Trie and PREFIX_TABLE for Storing File Paths in a Minifilter Driver","slug":"choosing-between-adaptive-radix-trie-and-prefix-table-for-storing-file-paths-in-a-minifilter-driver","posts_count":4,"reply_count":0,"highest_post_number":4,"image_url":null,"created_at":"2025-06-11T08:05:53.884Z","last_posted_at":"2025-09-09T22:42:06.465Z","bumped":true,"bumped_at":"2025-06-11T22:41:38.921Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hello everyone, \nI want to store file paths with associated access rights in a minifilter driver. I’ve been comparing two data structures: \n\nAdaptive Radix Trie (ART): Dynamically adapts the node size for better cache lo…","visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":95,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":6,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":11439,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":6433,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":8667,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"FSFilter Security Monitor / .INF / Class & Class GUID","id":59693,"title":"FSFilter Security Monitor / .INF / Class & Class GUID","slug":"fsfilter-security-monitor-inf-class-class-guid","posts_count":7,"reply_count":2,"highest_post_number":7,"image_url":null,"created_at":"2025-05-30T18:16:56.554Z","last_posted_at":"2025-09-01T19:31:31.799Z","bumped":true,"bumped_at":"2025-06-03T19:31:15.777Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"I've recently been working on a new mini-filter driver project, and received the altitude assignment from Microsoft for it to be in the "FSFilter Security Monitor" load order group and in the altitude range 392000 - 3949…","visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":137,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":6,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":10430,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":11454,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":2683,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":644,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Preventing non-cached writes to normal files","id":59650,"title":"Preventing non-cached writes to normal files","slug":"preventing-non-cached-writes-to-normal-files","posts_count":5,"reply_count":0,"highest_post_number":5,"image_url":null,"created_at":"2025-05-15T15:07:07.670Z","last_posted_at":"2025-08-17T21:37:42.860Z","bumped":true,"bumped_at":"2025-05-19T21:37:41.662Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hi all, this topic was probably discussed before, but unfortunately I couldn't find an explanation for the behavior I am experiencing. \nI am developing a minifilter driver which goal is to prevent certain contents from b…","visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":106,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":6,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":11457,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":86,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":6373,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]}]}}