Windows Filesystem Minifilter Drivers: can I monitor and prevent FS operations using them?

Question

I need to:
1. Monitor operations on certain drives/paths
2. Prevent read and/or write operations on certain drives/paths
For example:

C://Users
D:

Can this be done using Windows Filesystem Minifilter Drivers ?

I am mostly interested in step 2. In other words can a minifilter cancel a IRP ?

Answer 1

Yes this is all possible with a filesystem mini filter driver.

For #1 you don't need a mini filter driver you could use a Win32 API like ReadDirectoryChangesW.

For #2 you can not only do that but you can also modify what gets read/written, even of different size.

You can get started here.

Answer 2

Raymond Chen, who is a long-time Windows developer, addressed a version of this question on his blog - he would recommend using ACLs for preventing operations rather than trying to get code to run to stop it. See his post on this for some thoughts...

Answer 3

I would suggest using Detours library to handle this task.