For our customers we need to provide good solution for backing up files created by our own software (actually previous version of file). All files should be sent to network path once modified (or created). Problem is there can be also some 3rd party software that writes to those files (this is why there was decision we need minifilter for this purpose). On first we assumed we could do file copy on preCreate callback (if file is not directory and is used to write_access then copy file to our location), but later we were looking at IRP communication and how files are opened (on customers machines) and it appeared there is plenty of software that opens files with full access (also our files) so it looks like we would do a lot of unnecessary copying (and network would be busy). So next idea came to do this on preWrite callback (if this is first IRP_MJ_WRITE for given handle (so we would store such information in handle context) we would first copy file and then let continue write to happen). Here question arise : is such thing (copy file on preWrite callback) good idea? Maybe you have some experience in creating of such solution and could give me an adivce?
As for doing a copy on first write, it’s possible, yes. But I’d probably do it when the file is memory mapped (read/write) or on first (user) write. At that point, copying it would be plausible.
There are potential concerns here, such as the time it takes to perform this operation and timeouts from components, leading to failures.
If you have a volume snapshot, you could copy from the snapshot, rather than the live copy; that has less impact.