I am developing a filter driver with the following requirements
a) New files created are actually created on a thawed location, but to the user and all applications it looks like they exist on the original location.
b) before modifying a file, a new copy is made on the thawed location, leaving the original intact.
c) While the filter is active, thawed location copies are used, but when it is unloaded it will be like the file never changed. All this without the user knowledge.
I researched about filesystem drivers and I'm able to intercept irps for creating, opening, reading and deleting volume, file, or directories. I also know how to modify the file Name object so that file redirection to another location can be effective. However how do i maintain the consistency for users and applications can still access the files in the original location without any problem?
Submit an article or tip