Attach/detach on format?

Seems like a straight question and something that should not even be queried…
But I have two minifilters that create multiple instances when a volume they are attached to is formatted. Even if they aren’t attached to the volume, it still creates 2 instances after the format.

The minifilter is an autoattach MF, attaching to all local volumes. I have tried checking if we are already attached by comparing FltObjects->Volume to the list of volumes we are attached to, but the volume is not present in the list, after format (as I’d expect).

What am I missing?

You end up with two instances on the new volume? Or is it that your old instance doesn’t go away and is still attached to the dismounted/dead file system?

The former would be spectacularly weird. The latter happens if there are still references to the old file system instance (either from you or from applications with handles open).

I get the old ones PLUS 2 per format per volume.
So if it is attached, that is 1 before format, 3 after 5 after 2 formats.

I am sorry to even mention this since I know you know all this but sometimes one forgets.

You have implemented all the stuff in the MN_DISMOUNT and MJ_PNP paths to call FltDetach()?

No, those two are not implemented callbacks at all.
Any docs that describe what needs to be done in this case?

One of the filters is so simple.

I am pretty sure that at least one of the samples does this and I always borrow that code. In your case I’m guessing that its the MN_DISMOUNT that needs to be done, but PNP is good hygiene too,

Only the metadata manager sample handles this, and yeah, it mentions the
instance will be visible to instance listing APIs.
I know the instance is not an issue per-se, as it is for an old volume
object, so there aren’t any double/triple callbacks.

This still does not explain why 2 new instances are made per volume?

Thanks, I will implement this.

Kind regards, Dejan Maksimovic.
FS Lead:

This still does not explain why 2 new instances are made per volume?

I’d guess that format process issues two successful MN_DISMOUNTs (one before and one after?)

@Dejan_Maksimovic : For My Info - can you let us know if this works?