I am using the delete minifilter example from msdn as a base: http://code.msdn.microsoft.com/windowshardware/Delete-File-System-b904651d
What I need to accomplish is:
I have a very vague understanding of minifilters and the filter manager, so I would like to know if this is even possible in principle before I delve deeper into the minifilter world.
short version - I need a way to determine a file will be deleted without a doubt and do some operations on that file.
You need to do all processing in pre callback, because all delete related information promoted to FCB on cleanup.
Getting a handle to a delete candidate in the DfPreCleanupCallback.
Retriving handle in cleanup path is bad idea, because it`s lead to handle count incremention for file object, that in process of cleanup. Instead of this just use FILE_OBJECT, that was given to pre callback (in operations with FltReadFile for example).
Doing some operations on the file that would have been
After cleanup request reach fs, it set FO_CLEANUP_COMPLETE on FILE_OBJECT and you very limited in what you can do with it. Also ensuring of file deletion could be done in pre callback only.