Hello,
I’m developing a File System Filter Driver, I hook the function IRP_MJ_CREATE in order to processes files when opened or created, and depending of certain conditions the operation is aborted. The problem is when I tried to delete a file that match the desired condition, the operation is aborted too, and I can’t delete the file.
We know that the idea is to send first a CLEANUP and then a CLOSE, but we still don’t know if the file is being created, read or deleted.
Please help us.