Minifilter - How to identify it is a file or directory

NTFSD
1

i am new to minifilter, with FILE_OBJECT received at pre-operation of
IRP_MJ_SET_INFORMATION, how to detect the FILE_OBJECT is a file
or directory ?

Please advise.

2

FltIsDirectory ?

i am new to minifilter, with FILE_OBJECT received at pre-operation of
IRP_MJ_SET_INFORMATION, how to detect the FILE_OBJECT is a file
or directory ?

3

oh, thanks for the hint, is working :o)

4

Additional question: The docs say:
“Note This routine can only be called on an opened file object.”

So it cannot be used in the pre callback of IRP_MJ_CREATE, can it?

5

Correct, you can not perform this call in pre-create. To determine if a
given file is a directory in pre-create you need to either 1) Open the
file and call the file system to retrieve the file attributes or 2) Open
the parent directory and perform a directory query passing the file name
getting the file attributes for the file.

It is better to perform the Flt call in post-create for performance
reasons though there may be cases where you can not do this.

Pete

On 8/16/2012 1:16 PM, xxxxx@hotmail.de wrote:

Additional question: The docs say:
“Note This routine can only be called on an opened file object.”

So it cannot be used in the pre callback of IRP_MJ_CREATE, can it?

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295