Can't get post operation called for IRP_MJ_VOLUME_DISMOUNT in minifilter

As title I register a post operation function for IRP_MJ_VOLUME_DISMOUNT in minifilter. But it never be called. How to get notification when a volume is dismounted success in minifilter. Thanks.

I’m thinkin’ you wanna post where people who write minifilters will read it… no?

Moving to NTSFD.


Thanks @Peter_Viscarola_(OSR)

Does anyone can help on this problem. How to get notification when a volume is dismount from the system in minifilter? Thanks!

Does your pre-operation callback get called?

I tried with InstanceTeardownStartCallback. it can be called by system but seems every time it delay about 5,6 seconds after the volume dismounted from the system. so if I plugin again I get the mounted and then the last teardown come but it is to late I can’t use it any more because the volume already mounted again.
for the pre-operation dismount callback even I can get it still can’t make sure if it success dismounted or not.

Hi @Scott_Noone_(OSR). It is weird I can’t event get pre-operation callback of dismount. Do you know why? Thanks.

Are you dismounting the volume or removing the device from the system? They’re different in Windows…If you’re yanking out a USB device that’s a PnP operation and you want IRP_MJ_PNP.