backup delete file File system filter driver

NTFSD
21

OK, your right! how can I rename file? and in which dispatcher?

22

>how can I rename file?
FltSetInformationFile with a FILE_RENAME_INFORMATION.

and in which dispatcher?
IRP_MJ_CREATE and IRP_MJ_SET_INFORMATION. See initial reply.

I suggest you start out with the filespy sample. Then modify it to list
files that are being deleted, list every time a file has a delete flag
getting set or cleared. Then you get a good idea of the type of activity
your filter will be exposed to.

//Daniel

23

finally what I must do with this list?