Please Help: NTFS file context transparent...

Hi All Experts,

I am just a beginner working on an encryption project with reference to
the filespy filter example. So far under FAT, I don’t deal with fast I/O
path but just intercept the read/write IRPs, and I can manipulate the file
contents with no problem (testing with notepad). But today when I attached
my filter to an NTFS volume, I couldn’t see the file context anymore! So
scared :frowning: What I observed is that, the message flow still consists one
IRP_MJ_READ (on FAT I saw two). When I set the break point and got current
IRP stack, I didn’t see the content in the buffer(this also confused me,
that my breakpoint for READ got called several times but the log file only
showed once). Searching the mail list, it seems like no one mentioned that
NTFS makes a difference with FAT on this. How you guys experts deal with
this???

Thanks a lot in advance,

  • Michael