I’m trying make backup files copy driver (shadow copy),but unsuccessfully in general case…
I’m wrote filesystem minifilter driver and try in pre-operation-callback for write request make my copy,but have problem with TopLevelIrp and PAGING_IO (cause deadlock when TopLevelIrp != NULL and fails filesystem request (ZwWriteFile,IRP_MJ_WRITE)).
I’m try use pending IRP in pre-write-operation-callback and complete after backup copies,but it’s fails for TopLevelIrp != NULL (http://msdn.microsoft.com/en-us/library/windows/hardware/ff543449(v=vs.85).aspx)…
I’m using worker thread wich write content from pre-operation-write-callback to backup file,but in this case memory for thread queue overflows because post data to queue from callback faster then writes backup file…
How it’s work in DLP system (shadow copy)? May be somebody will suggest a right way?