Excluding everything but regular files

NTFSD
1

From a Create callback function in my mini filter driver i need to exclude
everything else than regular files (meaning that i don’t need to process dir
files, stream files ect.)

What’s the fastes and most efficient way to do that??

Driver needs to be woking to Win2K_SP4 and above

Thanks, SSJ

2

Hi SSJ,

From a Create callback function in my mini filter driver i need to exclude
everything else than regular files (meaning that i don’t need to process dir
files, stream files ect.)

Well, REGULAR FILE can have different meanings in different scenarios.

However, if you want to detect if the FILE_OBJECT is a stream file object, you can check for FO_STREAM_FILE flag in the fo->Flags field.
For detecting whether it represents a directory, you can use FltIsDirectory.
Kindly do the above only after receiving PostCreateCallback.
If you want to use this information in further operations on that file (stream to be specific), you can use stream context facility.

Regards,
Ayush Gupta