Minifilter intercepting request from perticular folder only

NTFSD
1

Hello everyone,

I’m trying to find a way to intercept I/O requests that originate from a specific folder using a minifilter driver. I understand that attaching the minifilter to the volume containing that folder works, and that I could also filter requests by checking for a path prefix match. However, I’m wondering if there’s a more efficient approach that allows interception of only the I/O requests from that particular folder, since prefix matching seems costly in terms of performance.

Thanks in advance!

2

You need to do the prefix matching in your filter. There is no option for only filtering specific folders of a volume.

3

Thanks @Scott_Noone_OSR for your response.

4

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.