Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results


More Info on Driver Writing and Debugging

The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.

Check out The OSR Learning Library at:

Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

Does IRP_MJ_SHUTDOWN in a minifilter gurantee that no more I/O is left pending

john-7john-7 Member Posts: 24


I have a requirement in my mini-filter to write some data to the volume after all writes to the volume are complete during the machine shutdown.
The mini-filter documentation states that only pre-op is supported for IRP_MJ_SHUTDOWN.
As per IRP_MJ_SHUTDOWN notification is received when all the file systems are flushed.
I am just wondering if it is at all possible in a mini-filter to ensure that all the FS writes are complete.

If not a mini filter driver, is there an alternative to get notified that all I/O is complete before the final writes can be performed.



  • Peter_Viscarola_(OSR)Peter_Viscarola_(OSR) Administrator Posts: 8,499

    In a word, no.

    When you get the IRP_MJ_SHUTDOWN, there is no guarantee that you won't get further I/O operations.

    Searching this forum for "IRP_MJ_SHUTDOWN Minifilter" will get you a very large number of posts that you might find interesting.


    Peter Viscarola

  • john-7john-7 Member Posts: 24
    edited November 2020

    Thanks Peter, one more query - during shutdown - for a mini filter is it possible that some IO writes are missed - i.e. a lower altitude driver or any other driver can perform some write operations which a higher order mini filter driver may miss because its teardown has been called. also does handling IRP_MJ_VOLUME_DISMOUNT may help this case?

  • Scott_Noone_(OSR)Scott_Noone_(OSR) Administrator Posts: 3,450

    The file system is the one responsible for determining the "last write" and it does this while handling the IRP_MJ_SHUTDOWN. So until the shutdown actually hits the file system any number of writes can happen. Also note that the file system will undoubtedly generate its own writes while handling the shutdown.


Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Developing Minifilters 24 May 2021 Live, Online
Writing WDF Drivers 14 June 2021 Live, Online
Internals & Software Drivers 27 September 2021 Live, Online
Kernel Debugging 15 November 2021 Live, Online