What does SFilter (from MS IFS Kit) has done ?

I try to use SFilter sample from MS IFS Kit for win 2k as the base for my
driver. I am trying to understand the operation of it. I cannot see any
debug messages from it when I perform any file I/O operations. However,
when I try “Loaded Modules” under Win 2k’s “Computer Management/System
Information/Software Environment”, a lot of debug messages displayed.

I really don’t understand what is going on with this sample. From the code,
I see a comment saying that

“// Attempt to open the RAW device object since this driver has already
// been started by system initialization and will not make it through
// the normal file system notification procedures otherwise.”

What is the exact meaning of this comment ? How can I fullfil this
requirment ?

If I want to use it to capture any file I/O from all attached device, how
should I modify it ? Is it incorrect to specify the device type as

If you’ve any idea, please let me know asap.

Thanks and Regards,

– Philip

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com