Getting fastio in minifilter

NTFSD
1

I am trying to build a filespy filter can anyone tell me how to intercept the fastio callbacks in minifilter.

2

FltMgr abstracts the Fast I/O callbacks as IRP_MJ_XXX operations. You can use the FLT_IS_FASTIO_OPERATION macro to know if the FLT_CALLBACK_DATA actually represents a Fast I/O operation:

https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/fltkernel/nf-fltkernel-flt_is_fastio_operation

1 Like