Can I catch file CREATION the operation in minifilter driver?

Question

I don't know English well. Plz understand me. :)

In the File System Minifilter Driver, I want to redirect file path of the operation creating file. So, I decided to use minifilter driver. I considered simrep sample project of MSDN. However, it is just showing like reparsing path. I mean, if I save a file in C:\aaa\abc.txt, then the file will be saved in C:\bbb\abc.txt. Just redirecting! And, though the driver will be detach and unloaded, abc.txt file will live in the C:\bbb\abc.txt.

Then, I want to catch the only the CAREATION operation in the callback routine handle IRP_MJ_CREATE. I know that callback routine of IRP_MJ_CREATE is called by opening as well as creating the file, device, etc. How can I do that?

Answer 1

If you mean creation of new file, then you can check for the following create disposition in pre create.

FILE_SUPERSEDED FILE_CREATE FILE_OVERWRITE FILE_OVERWRITE_IF

all this disposition happens when there is new file being created.