Recently, I played with FileSpy in Vista. On write operation
(invoked by just totally usual call of “WriteFile”,
I’ve observed IRP with flags 0x00060A00, which is
IRP_WRITE_OPERATION + IRP_DEFER_IO_COMPLETION + 0x00060000.
Has anyone a clue what does the 0x00060000 flag mean ?
It does not appear in Windows XP after the same operation.
It appears only in Vista, using both FSpy or MSpy filter.
It’s also there regardless of transaction or not.
L.