NTFSD Folk:
When signaled, my mini-filter must stop any writes to a specific file from
going to the disk, but let the application continue to run. It does this
until told to stop, typically 4-5 minutes later. My approach is to save the
data in paged pool and write it later (up to 4 MB – if I hit that limit it
aborts the whole thing).
The problem I’m hitting is deferred writes, i.e., IRP_DEFER_IO_COMPLETION is
set in the IRP flags for IRP_MJ_WRITE. Completing the I/O in the pre-write
callback (set IoStatus and return FLT_PREOP_COMPLETE) doesn’t seem to
satisfy the application. (Or maybe it is the cache manager or I/O manager?)
No other flags are set in the IRP – just IRP_DEFER_IO_COMPLETION and
IRP_WRITE_OPERATION. I can find very little information about what
IRP_DEFER_IO_COMPLETION actually does.
Any help?
Ken