Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.More Info on Driver Writing and Debugging
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
How to differentiate copy and modification Events happening on shared folder
System A has shared folder say "X". System B is accessing "X", now if system B copies a file from its local folder to shared folder "X" we see modification flag is set for this operation in cleanup I/O.
Similarly when system B modifies a file on shared drive "X" even then modification flag is set in cleanup I/O for this operation as well.
Is there a way we can differentiate between these two operation using flags or disposition.
Howdy, Stranger!
| Upcoming OSR Seminars | ||
|---|---|---|
| OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead! | ||
| Kernel Debugging | 16-20 October 2023 | Live, Online |
| Developing Minifilters | 13-17 November 2023 | Live, Online |
| Internals & Software Drivers | 4-8 Dec 2023 | Live, Online |
| Writing WDF Drivers | 10-14 July 2023 | Live, Online |
Comments
To answer your question, there are heuristic approaches, but they won't
even work for public, free apps sometimes.
If you just care for Explorer, then it's doable, it follows a lot of rules
for file copy, that it doesn't for other I/O.
Regards, Dejan.