It seems like there are two ways in precreate or postcreate minifilter callbacks to detect if its a request for creating/writing to a new file or a file that is already created :
1:
PFLT_CALLBACK_DATA Data
Data->IoStatus.Information == FILE_DOES_NOT_EXIST
2:
By checking the CreationDisposition
My question is, what is the difference? which one is better to use?
I just want to make sure my minifilter driver doesn’t process new file creations, i only want to monitor write operations on already created file (so therefore, if someone/a program copies some files to another location, i would ignore it), so i thought the best way is to ignore new file creations on pre/post create and allocate context only to those that want to write to already created files, using Data->IoStatus.Information == FILE_DOES_NOT_EXIST, is this the best way to do this?