Tracking files...

NTFSD
1

Earlier in this thread there were some hints on tracking per-file context
structures:

  1. In IRP_MJ_CREATE, create per-file context structure, and initialize it
    with lpFileObject->FsContext, or increment the reference count if the
    FsContext is already in the list.
  2. In IRP_MJ_CLOSE, decrement the reference count, if FO_STREAM_FILE flag is
    not set.
  3. If reference count is zero, and both ImageSectionObject and
    DataSectionObject are zero, delete the context structure.

The question is, if ImageSectionObject or DataSectionObject is NOT zero when
should I delete the context structure? Will I receive another IRP_MJ_CLOSE?

-htfv