The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
It seems like there are two ways in precreate or postcreate minifilter callbacks to detect if its a request for creating/writing to a new file or a file that is already created :
Data->IoStatus.Information == FILE_DOES_NOT_EXIST
By checking the CreationDisposition
My question is, what is the difference? which one is better to use?
I just want to make sure my minifilter driver doesn't process new file creations, i only want to monitor write operations on already created file (so therefore, if someone/a program copies some files to another location, i would ignore it), so i thought the best way is to ignore new file creations on pre/post create and allocate context only to those that want to write to already created files, using Data->IoStatus.Information == FILE_DOES_NOT_EXIST, is this the best way to do this?
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!|
|Developing Minifilters||24 May 2021||Live, Online|
|Writing WDF Drivers||14 June 2021||Live, Online|
|Internals & Software Drivers||27 September 2021||Live, Online|
|Kernel Debugging||TBD 2021||Live, Online|