how to know the details about operation of files in minifilter?

NTFSD
1

i mean ,i wanna know the file is copying or executing,reading or renaming? how should i do?

2

You cannot note copy in a minifilter. You can only note reads and mapping for execute.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

<galaxy.chen> wrote in message news:xxxxx@ntfsd…
>i mean ,i wanna know the file is copying or executing,reading or renaming? how should i do?
></galaxy.chen>

3

thx maxim… can u tell me the details? how should i do…

4

How should you do what ? Detect copying ?
You cannot detect that directly, I am not sure you detect it at all. Minifilters or file system filters are not made for this purpose but for detecting/monitoring FS activity making it abstract of the existing WIN32 API on top, or whatever UM framework is on top that implements different functionalities.

What is your final goal ? What are you trying to achieve here ?