MiniFilter File write protection Issue

nvdtrial

Hi All,

I have recently developed a minifilter based driver,
I have saved some specific folder's files from deletion, rename and modification.
It is working as per expected.

But, I have observed one peculiar issue in case of file modification protection.
If I modify protected file in notepad.exe and try to save it, it restricts from file save and file protection works as per expected.

But When I open the protected file in notepad++.exe and modify it, and try to save it, it got notification for save failed.
then I tried to close the modified file in notepad++.exe, it shows a msg pop up below :

"This File has been modified by another Program. Do you want to reload it and lose the changes made in notepad++."

if I press ** yes button**, all the content of the file get lost and file become empty and of size zero byte.

How to overcome this issue from file content get lost in notepad++.exe.

Any input will be appreciable.
TIA

Doug_N

These two statements:

I have saved some specific folder's files from deletion, rename and modification.

and

all the content of the file get lost and file become empty and of size zero byte.

can't both be true if your minifilter really is blocking ALL modifications. Is it just that notepad++ shows an empty file, but the file contents are still safe? If the file contents have actually been changed, some modification is still slipping past your minifilter.

Scott_Noone_(OSR)

Running ProcMon will let you see what file operations happen and their results.