Find the File type in mini filter driver

Hi all. I have a file system mini filter driver.Here I am trying to find the file type(eg .txt,.pdf) using file signature. Can you provide any solution?

Is there a possible way to get the file type using FltGetFileSystemType function

Obviously you need to read the file if you want to know what type of file it is. You absolutely, 100% do not want to do this in kernel mode, down that path lies madness (and an endless attack surface). FltCreateSectionForDataScan and a user mode parser?

1 Like