minifilter processing in ShutDown time

NTFSD
1

Hi,
I have an encryption file system minifilter driver that protect sensitive my files like office word files.
This protects huge files. Also, it has a scan mode that detects all sensitive files and encrypt theme.

I want to keep my files if an unexpected shutdown occured (especially in saving huge files and scan mode).
Are there any recommendation for minifilter code in shutdown system time? (except IRP_MJ_SHUTDOWN)

2

You do your background scanning and policy conversion in kernel mode? That’s painful, usually this stuff is much better served in user mode.

To answer your question: IRP_MJ_SHUTDOWN is your hint that the system is shutting down.