In kernel-mode I have a FILE_OBJECT. In user-mode some application creates a
file mapping, writes some data, and closes it. In kernel-mode I see paging
IRP_MJ_WRITE only after a couple minutes. But I need to know that
application wrote the data immediately. How can I do that?
And another question, if I open file after file mapping (and file itself) is
closed but before final paging IRP_MJ_WRITE goes, will I see those changes
made?
Thanks.