How can I tell if my minifilter driver is being shut down

NTFSD
1

Is there an On_Unload event or anything I can attach to that lets me know the minifilter driver is going to be shut down so I can do some cleanup work?

2
  • There are three callbacks (two pre, one post) to do with instance tear down where you should do most of the work.
  • There is MJ_SHUTDOWN for OS shutdown
  • And there is unload for driver state tear down

You should check the fine manual (starting here )

3

This might be the stupidest question I have ever asked, Unload and Entry? duhhhhhhh. I figured this out.

4

Thanks Rod, this actually helped me.