user mode file click events

NTFSD
1

hi all,

i am new to this file system driver, i want to know weather i will get the user event or operations over a file at filesystem driver or redirector!

for example if user clicks or double clicks to open a file can i see these events in FILE_OBJECT or any other structure ?

thanks for any help

2

> for example if user clicks or double clicks to open a file can i see these events in FILE_OBJECT

Single click - never.

This is the internal stuff in Windows shell, probably no syscalls at all are called due to this.

Double click - you will see MJ_CREATE usually.

Now note that “clicks” are at least 2 (if not 3) abstraction layers above the FSF, so, associating events from these different worlds is next to impossible.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com