Windows Filesystem Minifilter Drivers: can I monitor and prevent FS operations using them?
问题 I need to: 1. Monitor operations on certain drives/paths 2. Prevent read and/or write operations on certain drives/paths For example: C://Users D: Can this be done using Windows Filesystem Minifilter Drivers ? I am mostly interested in step 2. In other words can a minifilter cancel a IRP ? 回答1: Yes this is all possible with a filesystem mini filter driver. For #1 you don't need a mini filter driver you could use a Win32 API like ReadDirectoryChangesW. For #2 you can not only do that but you