I’m working through the Minispy sample in the IFS and am wondering about
whether there is a reason to grab some data in the Pre-Op callback vs the
Post-Op callback. I recognize that some data is only available in one or
the other (some contexts as I recall, and of course the ultimate Status
values), but other than the few exceptions, I think everything could be
grabbed and logged in the Post-Op callback (like filename, calling
PsGetCurrentProcessId, etc).
Is this just a case of a (very good) sample app showing lots of detail, when
in reality it might have better performance if it just registered a Post-Op
callback and did everything there?
Thanks for any feedback.
Doug (the newb)