I am working on a an FS minifilter registered for IRP_MJ_WRITE with SKIP_CACHED_IO. I am returning status_access_denied in preoperation callback. This works fine but for very small files, like < 100 bytes, the block operation doesnt prevent the update to the disk. After rebooting the server the contents of the file are seen. I saw some earlier threads and it appears that for very small files the content is stored in the MFT itself. When I use ProcessMonitor, I see a write success for the application and access denied for all subsequent paging IOs. Is there any other way to block the small write ?