I am brand new to this so please excuse the newbe questions. I am investigating the isolation filter for an on the fly encryption/decryption driver. I am trying to understand how the isolation minifilter uses the shadow file to populate the cache. I have been reading many threads on this topic but I am still confused. I have also been looking at the swapBuffer sample. In this sample for non-cached reads in the IRP_MJ_READ the minifilter allocates a new buffer and assigns this to the existing read buffer. In the post read it copies the data to this buffer which is returned to the calling application. For the cached I/O I understand that I create a new shadow file object and add it to the cache through the CcInitializeCacheMap(). This becomes the upper file object. Then I need to swap the target file in and out for the various IRP callbacks.
At this point the shadow file is the same as the existing FO. I believe that since I am now the owner of the file in the cache I am responsible to write the unencrypted content to the cached file. I think that I can use CcCopyWrite to do this. For a read operation when is this typically done? Do I do this as part of the IRP_MJ_READ or is there another place where this is typically performed?
Thanks for any pointers on this.