problem with cache in a swapbuffer example

I have a modified swapbuffers sample which identifies the encrypted files on the file system (based on a header applied to them), and swaps the encrypted contend with decrypted content in the post-read callback of the minifilter.

the problem I encounter is:
The OS caches the content I swapped for the first time and I receive the cached content(which is the decrypted content) next time I process the file(in post read) instead of the disk content. But I expected an encrypted content and try decrypting it in the post operation, resulting the wrong content.

I tried setting the IRP_NOCACHE flag in Data->Iopb->IrpFlags(in pre-read callback), to force the OS to fetch the contents from the disk. But it does not solve the problem in all conditions. trying to read the file using notepad shows me the correct content. also copying the file using explorer results to a correct target file which works fine with applications. but trying to open the original file using some applications(in my case a PDF reader), the file fails to be processed. (maybe it fails to read or maybe it receives the wrong content.)

any idea or hint?

I was reading topics on this forum on what could cause the situation I observe. they look rational but how I can overcome this issue?

You need to only decrypt when you receive a non-cached I/O, otherwise the data is coming from the (decrypted) file system cache.


Thanks scott. That’s right.