How do I detect when a new directory is being created in a mini-filter? I
created a new folder in explorer and looked for an IRP_MJ_CREATE with that
name. I don’t know if I was doing everything right or not but I couldn’t
seem to find any with that name. I saw the existing parent directory being
opened but that is all.
Directory is created using IRP_MJ_CREATE with FILE_CREATE
as CreateDisposition and FILE_DIRECTORY_FILE in the CreateOptions.
If you want to see it, download the FileSpy tool
from http://www.osronline.com, which is able to show you
the complete parameters of IRP_MJ_CREATE.
L.