Hello,
In my mini-filter’s when the instancesetup callback is called with automatic attachment, I send the volume name to the UI app to determine if it is interested in monitoring that volume and return STATUS_FLT_DO_NOT_ATTACH. If the volume needs to be monitored then the app issues a FilterAttach request which end up again in the instancesetup callback but this time with manual attachment bit set. The mini-filter then happily returns STATUS_SUCCESS.
The problem is when I insert a USB, the instancesetup is called twice with automatic attachment bit set. The first time, FilterAttach fails with ERROR_FLT_INSTANCE_NAME_COLLISION but the second time it succeeds.
What is going on? Why am I getting two instancesetup callback for the same volume?
I read elsewhere that the FS Loader will try to load the USB volume as NTFS but since it is a FAT32 drive it will fail the first time, it will then load it correctly as a FAT32 volume. Is that what is happening?
Please help.