FILE_OBJECTS creation notification

NTFSD
1

Is there a way to receive a notification when a FILE_OBJECT is created ?

2

A file system Minifilter?

Hmmm… Are you asking "Can I be notified about FILE_OBJECT creations, like I can be notified of Process or Thread Object creations using the Object Manager callbacks?? If that’s what you’re asking, to the best of my knowledge, the answer is “no.”

That’s why we have Minifilters :slight_smile:

Peter

1 Like
3

> @“Peter_Viscarola_(OSR)” said: > A file system Minifilter? > > Hmmm… Are you asking "Can I be notified about FILE_OBJECT creations, like I can be notified of Process or Thread Object creations using the Object Manager callbacks?? If that’s what you’re asking, to the best of my knowledge, the answer is “no.” > > That’s why we have Minifilters :slight_smile: > > Peter > @“Peter_Viscarola_(OSR)” said: > A file system Minifilter? > > Hmmm… Are you asking "Can I be notified about FILE_OBJECT creations, like I can be notified of Process or Thread Object creations using the Object Manager callbacks?? If that’s what you’re asking, to the best of my knowledge, the answer is “no.” > > That’s why we have Minifilters :slight_smile: > > Peter > @“Peter_Viscarola_(OSR)” said: > A file system Minifilter? > > Hmmm… Are you asking "Can I be notified about FILE_OBJECT creations, like I can be notified of Process or Thread Object creations using the Object Manager callbacks?? If that’s what you’re asking, to the best of my knowledge, the answer is “no.” > > That’s why we have Minifilters :slight_smile: > > Peter He should filter mj create right?