Multiple write calls with FO_STREAM_FILE set

NTFSD
1

Hi,
I observed that when I write some data to a file then minifilter write
opeartion callback routines gets called multiple times with FO_STREAM_FILE
flag set.
For which things these write calls belongs to (for eg file data, metadata or
something else)??
Also how can I distinguish file data from other things??
Basically I want to query Extended Attributes in write callback routine but
it gets failed in some of these write calls.

Thanks in advance.

–
Kapil Bhadke

2

MSDN says The file object represents a file stream.

According to this OSR article: http://www.osronline.com/article.cfm?article=102
It seems if the File Object is created by IoCreateStreamFileObject, IoCreateStreamFileObjectLite, or IoCreateStreamFileObjectEx, you will also see this Flag.

I think it could be any file.