The InstanceSetup callback (PFLT_INSTANCE_SETUP_CALLBACK) is called twice for the same volume

NTFSD
1

Hi,

While developing my minifilter, I noticed that the InstanceSetup callback (PFLT_INSTANCE_SETUP_CALLBACK) is called twice for every NTFS volume.
This results in 2 instances of my filter on the same volume (at different altitudes).

So my question is as follows:

  1. Why does it happen?
  2. How can I prevent it?

Thanks,
-Y

2

That should not be the case. Recheck your setup.

3

This results in 2 instances of my filter on the same volume (at different altitudes).
Check you registry settings. It is quite feasible to have the same filter at multiple altitudes, but you have to tell it to do so.