Hello everyone,
I am trying to compile a list of operations that I should look out for to track changes to a volume. Assuming that the scope is really limited to operations targeted on the volume and not those that kill off an entire volume entry from the partition table, etc. In terms of the actual IRPs/ IOCTLs, what I am hoping to get is stuff of sort IRP_MJ_WRITE, IOCTL_DISK_COPY_DATA, etc.
Another thing I am trying to find out is a list of operations that may bypass the volume filter.
Thanks in advance!
Tushar