regarding IRP_MJ_WRITE

hi guys,

Im developing a simple crypto file system filter driver where i need to
encrypt few files(ex - e:\test1.txt). I am able to filter the paging write
Irps done by system on that file and im encrypting the data.

The problem is

  1. When i open the file its still normal. But when i restart the system and
    open the file, It is encrypted! I think even after the pageing write
    operation the file still remains in memory. Is there a way i could do any
    thing to remove the file from memory after the page write done by system.

  2. Given a file name, can I know the number of handles that are opened
    currently by different processes from a filter driver.

Regards
VC