Prevent multiple callback on same filenamr

Hello Everyone. I have a minifilter which in callback operation get filename and send it to usermode app to logging(or scanning) it works fine . But there are multiple pre or post operation on same filename. I know its normal because when we work file we are not alone system also may access this file. But is there any way to prevent this. I mean i know we can stop these operation but how can I create minifilter to see same filename only one time?I readed about context stream but i dont know which type i must use?stream,streamhandle or etc?Can someone help me to understand context and give me some of resource(sample)?Thank you for reading

While it’s not intuitiveLy obvious, names are one of the more complicated things in the file system filter space (hard links, junctions, open by ID, renames, network vs local, it goes on and on…). So, I suggest you step back a bit and not worry about names for the moment. You undoubtedly want a stream context. On FAT this would be the same as per-file, but on NTFS (and other file systems, e.g. UDF) files can have multiple data streams. These each have a unique path and for most purposes can (effectively) be thought of as unique files. The general flow for scanning/monitoring is to establish a stream context on PostCreate. The first thread to set the stream context “wins” and triggers the monitoring/scanning. Subsequent threads look up the context and piggyback on the work of the first thread. Set up a secondary drive with FAT and play with the avscan WDK sample. Try to avoid the noise and hyper focus on its use of the stream context. It should help give you an idea of the flow. From there you have a million rat holes to fall down :slight_smile: Good luck!

Thank you very much Mr Scott for reply.I know my questions are newbie. I actually will not play fat or network .Im intrested only Ntfs and only executable file. I know there is also special major function for work executable irp mj acq for section but i saw in here there is also problem for reading file from user mode. Firstly I tested irp_mj_set_information it works fine there is no any problem. in post callback i get renamed file name and scan this.( like when browser download file after downloading browser rename filename to its original filename)There are not a lot of callback. But when try irp-mj-create i parse filename to catch only exe extension it also works but multiple same filenames. ( if im not wrong i must use stream context for this reason). And my 3rd options is irp mj write .I also tested it but i cant scan writing stream(consider I write data to file block by block) then i cant know when file writing operation completed.for this reason i used irp mj close but i cannot see any callback notify when user call CloseHandle after writing operation.