How to clear the cache before filtering IO?

NTFSD
1

Hi,

I have an FSD minifilter that encrypts noncached IRPs for specified
files. The FSD works fine if none of the specified files are read
before the FSD starts filtering (FltStartFiltering()). However, if an
encrypted file is read before filtering, the file is not decrypted
during filtering (probably because it is in cache). To solve this, I
believe I need to clear the cache or disable reading of encrypted
files before filtering.

  1. What is the better solution (clear cache or disable reading)?
  2. If I clear the cache, how do I clear the cache before filtering?
    Any documentation or APIs?
  3. If disable reading, how do I disable reading of the specified file
    before the start of filtering?
  4. Is there a better solution to this? Is reboot the only option?

Thank you,

Marc

2

> To solve this, I believe I need to clear the cache or disable reading

of encrypted files before filtering.

No. To solve this, you must ensure that your filter will be
in memory sooner than the first file from the disk will be ready
through the file system. So you must load your driver at boot time.

Or, you may unmount the volume, which will flush the cache.
However, the system volume cannot be unmounted.

L.