I am planning to port a legacy file system filter driver to mini filter driver.
In my mini filter driver I need to check on Mount Request(IRP_MN_MOUNT_VOLUME) and do house keeping operation. I need to get hold of the first write or read to the volume. so I sniff for IRP_MN_MOUNT_VOLUME.
I already have a minifilter driver for other purpose in FSFilter Activity Monitor group.
My question is can I add my current functionality to check on Mount Request(IRP_MN_MOUNT_VOLUME) to the same mini filter driver or should I write a new mini filter driver for my new functionality.
Doc says FSFilter Activity Monitor group observes and reports the file I/O, I don't think checking for IRP_MN_MOUNT_VOLUME is a file I/O operation.
FSFilter Activity Monitor : This group includes filter drivers that observe and report on file I/O
In which load order group my driver should be if I write a new mini filter driver
Thanks in advance