Identifying a set of operations

yanivnac

Hi all,

Let's say I have a set of operations for deleting a file - that is create, setfileinformation and close. What is the best way to uniquely identify this flow in my mini-filter? is there sort of a unique id?

Thanks in advance.

rod_widdowson

No.

You can look for all sorts of heuristics (thread Id and File Object or FsContext2 might be somewhere to start), but nothing is guaranteed.

And of course there are many other ways that a file can be deleted..

Gabriel_Bercea

Check out the delete sample from microsoft.
https://github.com/Microsoft/Windows-driver-samples/tree/master/filesys/miniFilter/delete