FltCreateSectionForDataScan called in PostCreate for read attributes only

NTFSD
1

Hi,

I am doing just usual stuff like AV file scanning in PostCreate. But what if I decide to scan a file which is opened only for read attributes.
Obliviously the open file request for read attributes would succeed even if other applications have exclusive access to the file (read and share none). In most of the cases I see that FltMgr is able to synchronize conflicting operations, but there are cases like HLK Syscache Test which fail for exFat. The section conflict notification callback is not called, but the test reports corrupted cache.

What do you think about this? Is there any restriction about FltCreateSectionForDataScan that I should not scan file that are not opened for read access?

2

I'd think that works in theory but it would certainly be unusual...Do you really need to do this? Why not just wait for an open with actual read access?

3

Doing this it's basically a powerful tool to make on-demand scan on files that are open for exclusive access, or not to cause conflict to other applications while scanning on-demand. It is my application that triggers my own PostCreate for read attributes (by opening for read attr).

4

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.