I try to use SFilter sample from MS IFS Kit for win 2k as the base for my
driver. I am trying to understand the operation of it. I cannot see any
debug messages from it when I perform any file I/O operations. However,
when I try “Loaded Modules” under Win 2k’s “Computer Management/System
Information/Software Environment”, a lot of debug messages displayed.
I really don’t understand what is going on with this sample. From the code,
I see a comment saying that
“// Attempt to open the RAW device object since this driver has already
// been started by system initialization and will not make it through
// the normal file system notification procedures otherwise.”
What is the exact meaning of this comment ? How can I fullfil this
requirment ?
If I want to use it to capture any file I/O from all attached device, how
should I modify it ? Is it incorrect to specify the device type as
“FILE_DEVICE_DISK_FILE_SYSTEM” in the sample ?
If you’ve any idea, please let me know asap.
Thanks and Regards,
– Philip
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com