I’m implementing a HSM driver that makes files resident on demand as IRP_MJ_CREATE comes in for a file that contains my reparse point. To further narrow down when I actually attempt to make a file resident I check the access flags for FILE_READ, FILE_WRITE, or FILE_APPEND.
These checks have narrowed down the times I actually need to make a file resident to very few instances, but some CREATEs are coming for thing like when the user single clicks a file, or right clicks a file, when the file really does not need to be made resident.
Is there a way to discriminate why a CREATE is being requested? Alternatively, is there any way to tell if the CREATE request will really need access to the file data?