Hello Folks,
I am trying to perform file and directory exclusion on a volume filter driver. The volume filter driver just redirect to free space so that on reboot all change seems to have been reverted. I associated a mini filter driver to track file in an exclusion list and perform diverse actions.
Using an Master File Table parser I was able to track file records of those file in my exclusion list and consequently able to handle exclusion of resident files and also file attributes. My problems arise when new clusters have been allocated for those files in my exclusion list that have been modified. In fact I verified that the Bitmap tracking excluded file is the same on reboot , but I still cant figure out why some times, partial parts of the file are corrupted and some times the process just work fine.
I would really appreciate if somebody could help me progress.