I have a minifiler driver which tracks files and tags them with ADS when it has seen certain data being written. My problem is that sometimes the file is written to by the Cache Manager after the Cleanup so I have to wait until the Close to be certain that I have seen all of the data written to the file. Unfortunately the pre-close is IRQL <= APC_LEVEL so I can't use FltCreateFile. I don't want to make the tagging asynchronous because sometimes the file gets renamed after it has been closed.
Can anyone suggest a way to get around this? Can I prevent the caching for the files I'm interested in, or somehow do file operations at APC_LEVEL?