Hi, guys.
I am writting a minifilter driver, I need to detect usb disk plugin and remove.
I registered InstanceSetup?InstanceQueryTeardown?InstanceTeardownStart?InstanceTeardownComplete callbacks.
But only InstanceSetup callback works as expected.
QueryTeardon?TeardownStart?TeardownComplete were not called when I removed usb disk.
Is there anything I was overlooking?
Thanks!
Alex.
Is there anything I was overlooking?
In a word, yes. For reasons I never understood FltMgr doesn’t automatically
call you at dismount. Everybody assumes that it will do this, but it
doesn’t.
You need to filter IRP_MJ_FSCTL and IRP_MJ_PNP and call FltDetach
appropriately. Fortunately the MetadataManager example shows you how to do
this…
Rod Widdowson
Consulting Partner
Steading System Software LLP
+44 1368 850217 +1 508 915 4790
wrote in message news:xxxxx@ntfsd…
> Hi, guys.
>
> I am writting a minifilter driver, I need to detect usb disk plugin and
> remove.
> I registered
> InstanceSetup?InstanceQueryTeardown?InstanceTeardownStart?InstanceTeardownComplete
> callbacks.
>
> But only InstanceSetup callback works as expected.
> QueryTeardon?TeardownStart?TeardownComplete were not called when I removed
> usb disk.
>
> Is there anything I was overlooking?
>
> Thanks!
>
> Alex.
>
Thanks Rod!
The sample helps me a lot. Thanks very much 
Rod,
I modified my driver to prepare recieving FSCTRL_DISMOUNT_VOLUME and IRP_MJ_PNP.IRP_MN_SURPRISE_REMOVAL. But there was no such irps coming to my driver when I plugin and remove my usb disk.
Sorry, I made a mistake.
I’ve recived PNP.IRP_MN_SURPRISE_REMOVAL.
Thanks