Hi all,
I write filesystem filter driver.
I catch IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES in Pre- and PostDeviceIOControlCallback. And after the only one snapshot I catch it twice in each callback.
I suppose that theoretically it can happens because of the system send this control code to the volume once and once again to the filter instance.
I did an experiment. I tried to print all filesystems entries between pre- and post- callbacks.
As a result I see that between the first IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES in PreDeviceIOControlCallback and the first IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES in PostDeviceIOControlCallback there are no entries. But during the second IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES there are few entries to the filesystem to $Log and to $mft.
It looks like that my theory is true and in first case this control sent to my filter-driver instance and the next one to the hard disk volume.
How do you think, does it sounds true?
My filter driver instance has a number of buffers and it writes all filesystem entries in them. I need to choose right time to write buffers to the disk. And in the same time don’t lose any entries that connected with this snapshot.
In which moment I should to do this?
Thank you