Mini-filter notification of mount point changes?

NTFSD
1

Is there any way for a mini-filter to get notified of mount point
changes, without polling or user mode intervention?

–
Kind regards, Dejan
http://www.alfasp.com
File system audit, security and encryption kits.

2

Just a guess, but I would think your instance setup callback would be
invoked, in this case with the FLTFL_INSTANCE_SETUP_NEWLY_MOUNTED_VOLUME
flag set; should be easy enough to check if that is true.

HTH

-----Original Message-----
Is there any way for a mini-filter to get notified of
mount point changes, without polling or user mode intervention?

–
Kind regards, Dejan

3

No, doesn’t happen. Probably because mount point changes to do dismount/mount a
volume.

“Vossen, Joseph (ISS Atlanta)” wrote:

Just a guess, but I would think your instance setup callback would be
invoked, in this case with the FLTFL_INSTANCE_SETUP_NEWLY_MOUNTED_VOLUME
flag set; should be easy enough to check if that is true.

–
Kind regards, Dejan
http://www.alfasp.com
File system audit, security and encryption kits.