Assume we’ve got a local and a network drive in the system (can be a folder mapped to the letter).
I need to track down the files that were copied from the network drive(s). It’s possible to track individual files located on the local drive by writing callbacks for IRP Event (e.g. IRP_MJ_CREATE, IRP_MJ_WRITE) and filtering them, but since the structure PFLT_CALLBACK_DATA and its inner substructure PFLT_IO_PARAMETER_BLOCK contains no information about where the file was copied from, I am unable to make any progress and find API in MSDN that could somehow be relatable.
Any suggestions?