Monitor New Creation File on pre&post call back

NTFSD
1

Hi, i’m new in this forum and Minifilter driver
i wanna monitor just New File Creation Operation on PreCreated and PostCreated Callback
i try to (irp->IoStatus.Information == FILE_DOES_NOT_EXIST) but does’t work
how can i do that?
thank you all

i’m apologize
this correct (Data->IoStatus.Information == FILE_CREATED))

2
  1. Create a secondary FAT32 volume and only attach your filter to this volume
  2. Have your filter print out information for every Pre/PostCreate operation
  3. Use FileTest to create some files/perform file operations
  4. Look at logs and try to understand what’s happening
  5. Repeat steps 3-4
1 Like
3

thank a lot