process renames using a minifilter

NTFSD
1

Hi!
I am writing a minifilter that will eventually be used to mirror a volume. I need to detect file renames. Basically I need the old and new file names. What would be the best way to do that please?

2

FltGetFileNameInformation gets the “now” information
FltGetDestinationFileNameInformation gets the “new” information

Of course that will only return the names as they are/would be at that
particular moment…

Hi!
I am writing a minifilter that will eventually be used to mirror a volume.
I need to
detect file renames. Basically I need the old and new file names. What
would be the best way to do that please?

3

Thx for your reply.

Would it be correct to call FltGetDestinationFileNameInformation from a Post Create function? And are there any flags I could check which indicate a file rename instruction?

4

FltGetDestinationFileNameInformation is typically called from the actual
IRP_MJ_SET_INFORMATION callback. You can of course call it from anywhere
provided that you can set the parameters the right way. So yes, you can call
it from postCreate but I don’t know where you’d get the right parameters
from.

In general you will see the SL_OPEN_TARGET_DIRECTORY flag set in the
CALLBACK_DATA->Iopb->OperationFlags for the create that opens the target
directory for a rename operation.

Thanks,
Alex.