When I load my minifilter I’m seeing 2 calls for each mounted volume, eg:
Instance setup started (Volume = 86438BB0, Instance = 85BD0C48)
Vol Dev Type = 8 Vol Fs Type = 2
Flags = 1
Volume Device Type: DISK FS Id 8
FltGetVolumeName. Volume = 86438BB0, Instance = 85BD0C48, Name = \Device\HarddiskVolume1
.
followed by virtually identical call for the same volume, only the Instance (FltObjects->Instance ) is different?
[RDMCtx]: Instance setup started (Volume = 86438BB0, Instance = 85BD0008)
Vol Dev Type = 8 Vol Fs Type = 2
Flags = 1
Volume Device Type: DISK FS Id 8
[RDMCtx]: FltGetVolumeName. Volume = 86438BB0, Instance = 85BD0008, Name = \Device\HarddiskVolume1
Nothing magic with filter registration:
CONST FLT_REGISTRATION FilterRegistration = {
sizeof(FLT_REGISTRATION), // Size
FLT_REGISTRATION_VERSION, // Version
0, // Flags
Contexts, // Context
Callbacks, // Operation callbacks
FilterUnload, // FilterUnload
RDMCtxInstanceSetup, // InstanceSetup
RDMCtxInstanceQueryTeardown , // InstanceQueryTeardown
RDMCtxInstanceTeardownStart, // InstanceTeardownStart
RDMCtxInstanceTeardownComplete, // InstanceTeardownComplete
NULL, // GenerateFileName
NULL, // GenerateDestinationFileName
NULL // NormalizeNameComponent
#if 0
#if VERSION_LONGHORN
,
SpyKtmNotificationCallback
#endif // MINISPY_LONGHORN
#endif
};
Any ideas why this might be?
Larry