Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTDEV

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

Using FILE_DOES_NOT_EXIST vs CreationDisposition for detecting new file creations in minifilter?

brad_Hbrad_H Member Posts: 18

It seems like there are two ways in precreate or postcreate minifilter callbacks to detect if its a request for creating/writing to a new file or a file that is already created :
1:
PFLT_CALLBACK_DATA Data
Data->IoStatus.Information == FILE_DOES_NOT_EXIST

2:
By checking the CreationDisposition

My question is, what is the difference? which one is better to use?

I just want to make sure my minifilter driver doesn't process new file creations, i only want to monitor write operations on already created file (so therefore, if someone/a program copies some files to another location, i would ignore it), so i thought the best way is to ignore new file creations on pre/post create and allocate context only to those that want to write to already created files, using Data->IoStatus.Information == FILE_DOES_NOT_EXIST, is this the best way to do this?

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Developing Minifilters 24 May 2021 Live, Online
Writing WDF Drivers 14 June 2021 Live, Online
Internals & Software Drivers 27 September 2021 Live, Online
Kernel Debugging TBD 2021 Live, Online