Hi all!

My FS filter driver inspects the files content in Create and ReadWrite

I used ZwCreateFile (with FILE_NO_INTERMEDIATE_BUFFERING flag). “?:” prefix
was added to the file name and this prefix

was removed in my Create routine and Irp was forwarded to the next device.
Then ZwReadFile was called on the

file handle received from ZwCreateFile.

I have replaced ZwCreateFile by IoCreateFileSpecifyDeviceObjectHint and the
read Irp is built now using IoBuildSynchronousFsdRequest.

It changed the driver’s behavior. If a small file (less than 256K) is copied
form disk on key to the hard disk, the filter driver doesn’t see any

Read Irp. It seems that my internal read fetches data to the cache. I had
the same problem with ZwCreateFile, but FILE_NO_INTERMEDIATE_BUFFERING

flag solved the problem.

Any idea?