Hello!
After Installing my driver, Windows prompt for restart to apply changes. Then after restarting, From the User Mode, I store the unique identifier in the registry which I made to distinguish the disks and In Kernel Mode Driver.
Then I check for that disk and Intercept the IOCTL_DISK_IS_WRITABLE. I am calling the EvtIoDeviceControl to intercept the IOCTLs and then I am returning STATUS_MEDIA_WRITE_PROTECTED like:
if (IoControlCode == IOCTL_DISK_IS_WRITABLE) {
WdfRequestComplete(Request, STATUS_MEDIA_WRITE_PROTECTED);
DbgPrint("IOCTL_DISK_IS_WRITABLE Write operation blocked for device with pdoName: %ws\n", pdoName);
return;
}
In Disk Management, It shows Read Only in for the particular disk, But in the Explorer I can still create and write file for the same disk.
But after restarting again, The disk goes back to previous state like it deletes whatever files I created and the writes too and shows as Read Only everywhere!
That's the main problem!
Can someone please tell me why is this happening and how can I immediately notify windows that the disk is write protected without restarting it again?