RE: RE: RE: [ntfsd ] FileObje= ame , who? s the owner ?

This may be the way …

You?re the CARA Fernando ! or the COROA …


Date: Mon, 3 Dec 2012 08:57:13 -0500
Subject: [ntfsd] RE: RE: [ntfsd] FileObje= ame , who? =?iso-8859-1?Q?s_the_owne?= =?iso-8859-1?Q?r_=3F?=

Hi Dorival,

If you’re looking for the requestor application for a given IRP, can you can use FltGetRequestorProcess routine.

If you’re looking for the user account that is trying to open the file, you can raise that info using the SecurityContext member of FLT_PARAMETERS for IRP_MJ_CREATE.


Fernando Roberto da Silva
DriverEntry Kernel Development

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:

To unsubscribe, visit the List Server section of OSR Online at