How to match MUP and local creates ?

NTFSD
1

Hello

Let’s say I open file through network share \127.0.0.1\share\file.txt.
In that case I see two creates - one on mup and another on local volume e:\share\file.txt.

How can I discover in my minifilter in create dispatch that \127.0.0.1\share\file.txt and e:\share\file.txt is the same file ?

2

Not in any safe way that I know of. You cannot even tell that \127.0.0.1\share\file.txt and \\::1:\share\file.txt are the same

3

Thank you Rod
I thought so :frowning: