Handling shutdown for volume filter driver

NTFSD
1

I am writing a upper filter driver for volume manager.
My goal is change block tracking for volume attached.

  1. My question is how to handle shutdown/Remove device request. Which
    function will be appropriate for that.
  2. I am receiving IRP_MN_REMOVE_DEVICE device when i delete volume using
    diskmanagement utility but not while shutdown. Is it expected behavior
2

Yes. The device stack is not disassembled on shutdown.
You should register for IRP_MJ_SHUTDOWN .