Instance Setup call back

What could be achieved from inside InstanceSetupCallBack?

How to attach my MiniFilter driver to an existing volume?

Does a Minifilter driver always attaches itself to the system volumes even if InstanceSetupCallBack is NULL?

> What could be achieved from inside InstanceSetupCallBack?

Sorry, I don’t understand the scope of this question. Can you clarify?

How to attach my MiniFilter driver to an existing volume?

If you have automatic attachment enabled, FltMgr will attach you to all
existing volumes.

If you DO NOT have automatic attachment enabled, you can call
FltAttachVolume from kernel mode or FilterAttach from user mode.

Does a Minifilter driver always attaches itself to the system volumes even
if InstanceSetupCallBack is NULL?

A NULL InstanceSetupCallback means that you consent to attaching to all
volumes. InstanceSetupCallback allows you to filter out volumes you are not
interested in as well as associate context with your instance.

HTH,

-scott
OSR
@OSRDrivers

Inside the InstanceSetupCallBack, you would make the determination on
whether you wanted to attach to that volume or not. The return value
determines whether FltMgr attaches you or not.

From the user space app, do “/a ” to attach.

Yes, the default functionality for instances when InstanceSetupCallBack
is NULL is to attach to the volume.

-Frank

------ Original Message ------
From: xxxxx@seclore.com
To: “Windows File Systems Devs Interest List”
Sent: 2/23/2017 3:28:42 AM
Subject: [ntfsd] Instance Setup call back

>What could be achieved from inside InstanceSetupCallBack?
>
>How to attach my MiniFilter driver to an existing volume?
>
>Does a Minifilter driver always attaches itself to the system volumes
>even if InstanceSetupCallBack is NULL?
>
>—
>NTFSD is sponsored by OSR
>
>
>MONTHLY seminars on crash dump analysis, WDF, Windows internals and
>software drivers!
>Details at http:
>
>To unsubscribe, visit the List Server section of OSR Online at
>http:</http:></http:>