Hi all:
I have a volume and some files on it.I mount the volume and read the files.But I keep the files unmodified.Then i unmount the volume.I notice that there are some IRP_MJ_WRITEs directed to some of the files(with IRP_NOCACHE setted).I’m puzzled about it because none of the files is modified.In which way can I distinguish such IRP_MJ_WRITEs from other common IRP_MJ_WRITEs?
Thanks!
Jim