Re[2]: MiniFilter redirection without STATUS_REPARSE. Is it possible?

There are several reasons why a STATUS_REPARSE would not get redirected.
It could be due to a kernel mode module performing an open on the file.
None of the standard APIs to open a file, such as FltCreateFile(), can
propagate the reparse information to the caller. There are several other
issues with STATUS_REPARSE and Alex has some great blog entries covering
the details of them in his blog, the first entry being
http://fsfilters.blogspot.com/2012/02/problems-with-statusreparse-part-i.html

There are no samples for a layered file system. As I mentioned, you can
search for the shadow file object term in this forum and come up with
many hits.

Pete


Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com http:</http:>
866.263.9295

------ Original Message ------
From: xxxxx@caiman.com.ar
To: “Windows File Systems Devs Interest List”
Sent: 6/23/2015 6:34:15 AM
Subject: RE:[ntfsd] MiniFilter redirection without STATUS_REPARSE. Is it
possible?

>Hi Peter, thank you for answering.
>
>a) Do you know, some hint, why sometimes returning STATUS_REPARSE does
>not trigger reissuing the request? Some calls have the
>FILE_FLAG_OPEN_REPARSE_POINT and/or FILE_FLAG_OPEN_NO_RECALL flags but
>others doesn’t. I cannot figure out some pattern.
>
>b) Is there some starting sample I can watch to begin a research?
>
>Regards,
>Mauro.
>
>—
>NTFSD is sponsored by OSR
>
>OSR is hiring!! Info at http://www.osr.com/careers
>
>For our schedule of debugging and file system seminars visit:
>http://www.osr.com/seminars
>
>To unsubscribe, visit the List Server section of OSR Online at
>http://www.osronline.com/page.cfm?name=ListServer

Hi Peter,

Yes I was watching Alex’s blog before asking here although I couldn’t find information related to this issue. Basically the first STATUS_REPARSE is returned when the low integrity WinWord does a GetFileAttributes.

I’ll follow your tip about shadow file objects.

Thank you very much,
Mauro.