Filter driver to monitor all hard disk or all partitions

NTFSD
1

Recently I wrote a file system filter driver to monitor c:\ drive by using string L"\DosDevices\c:\". I wanted to know what string parameter should I use to monitor all partitions in my hard drive or all partitions in all hard disks. Creating a device object for each partition or hard disk is too cumbersome.

2

What do you mean " Creating a device object for each partition or hard
disk is too cumbersome." How do you think you are going to do this?

Don Burn (MVP, Windows DKD)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

“xxxxx@hotmail.com” wrote
in message news:xxxxx@ntfsd:

> Recently I wrote a file system filter driver to monitor c:\ drive by using string L"\DosDevices\c:\". I wanted to know what string parameter should I use to monitor all partitions in my hard drive or all partitions in all hard disks. Creating a device object for each partition or hard disk is too cumbersome.

3

Instance1.Flags = 0x0 ; Allow all attachments

in your .inf file will do that.
Your mini filter will auto attach to all the drives on your machine.

4

Well, a minifilter doesn’t require creating devices for filtering so the way
I read the OP, this is a legacy filter. However, the way NT works you need
to create a device for any device you want to filter, and the local file
systems create devices for each volume. So as far as I know there isn’t any
easier way for legacy filters.

Of course, one of the main reasons for coming up with the minifilter model
was to make attachment much easier and more predictable.

Thanks,
Alex.