I need to start tracking the write IRPs happening on the volume. To do that I thought of starting my tracking once I receive IOCTL_VOLUME_ONLINE to that volume.
Can Read and Write IRPs come before IOCTL_VOLUME_ONLINE to a volume.
or should I rely on IRP_MN_MOUNT_VOLUME.
Basically should I start tracking once I receive IRP_MN_MOUNT_VOLUME.
which one is more reliable.
I remember I saw somewhere where people have mentioned that they have seen Read IRPs before IOCTL_VOLUME_ONLINE.
Thanks in Advance