IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES catched twice per snapshot

NTFSD
1

Hi all,

I write filesystem filter driver.
I catch IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES in Pre- and PostDeviceIOControlCallback. And after the only one snapshot I catch it twice in each callback.
I suppose that theoretically it can happens because of the system send this control code to the volume once and once again to the filter instance.
I did an experiment. I tried to print all filesystems entries between pre- and post- callbacks.
As a result I see that between the first IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES in PreDeviceIOControlCallback and the first IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES in PostDeviceIOControlCallback there are no entries. But during the second IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES there are few entries to the filesystem to $Log and to $mft.
It looks like that my theory is true and in first case this control sent to my filter-driver instance and the next one to the hard disk volume.

How do you think, does it sounds true?

My filter driver instance has a number of buffers and it writes all filesystem entries in them. I need to choose right time to write buffers to the disk. And in the same time don’t lose any entries that connected with this snapshot.

In which moment I should to do this?

Thank you

2

First of all as a file system filter there is no need at all to handle this IRP.
Tell us what and which specific you are doing in you filter and what your filter does??
You will get help earlier by doing this.

3

I track all the changes to the file system and logged them. At each time interval between snapshots creates a separate file that must be closed before the next snapshot. The goal is to write the next time buffer data file and close it before the next snapshot, it does not lose the data that will be flushed when the system get IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES