[OSR-DETECTED-SPAM] RE: minifilter IRP_MJ_CREATE

NTFSD
1

There is also this:
http://fsfilters.blogspot.com/2010/02/issuing-io-in-minifilters-part-1.html

I would suggest you capture a stack trace (in the debugger) the first time
you see the create and then then second time you see it and post them both
here so we can compare them …

Thanks,
Alex.

2

thanks for your quick reply…
I have another problem…
Actually I want to store multiple EAs for files and later I want to
retrieve it.
I was able to store multiple EAs with the help of FltSetEaFile(). But I am
unable to
retrieve those using FltQueryEaFile().
Everytime I am getting only 1st EA as a result.
What might be the problem??

thanks in advance…

On Tue, Feb 1, 2011 at 5:22 AM, wrote:

> Take a look at FltCreateFile(). You can use that to prevent recursion of
> file operations.
>
> This link is a great place to start to learn more about minifilters:
>
> http://www.microsoft.com/whdc/driver/filterdrv/default.mspx
>
> Specifically, look at Minifilter Generated IOs.
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

–
Kapil Bhadke

3

thanks for your quick reply…