I am Working on a minifilter to detect files write by some process in the PreWrite callback of IRP_MJ_WRITE. It works great when some files content is modified. But not getting PreWrite callback when the file content is modified and made to zero sizes. i.e select all then clear out the content and finally save the file. it is also kind of writing so why not getting a PreWrite callback?
How to prevent File writing(clear all content & save the file)?
or what callback do we get when file content is cleared(i.e becomes empty) and the file is saved?
As a beginner in minifilter, am I missing something or unaware of some concept?
Please guide/help me.
I will be very thankful to the OSR community.