This function determines whether or not the mini-filter should attach to the volume. FltObjects - Objects related to the filter, instance, and its associated volume. Flags - Flags that indicate the reason for the volume attach request. VolumeDeviceType - The device type of the specified volume. VolumeFilesystemType - The filesystem type of the specified volume. */
| 420 | VolumeFilesystemType - The filesystem type of the specified volume. |
| 421 | */ |
| 422 | NTSTATUS |
| 423 | FSBlockingFilter::HandleInstanceSetup( |
| 424 | _In_ PCFLT_RELATED_OBJECTS FltObjects, |
| 425 | _In_ FLT_INSTANCE_SETUP_FLAGS Flags, |
| 426 | _In_ DEVICE_TYPE VolumeDeviceType, |
| 427 | _In_ FLT_FILESYSTEM_TYPE VolumeFilesystemType |
| 428 | ) |
| 429 | { |
| 430 | NTSTATUS status = STATUS_SUCCESS; |
| 431 | BOOLEAN isWritable = FALSE; |
| 432 | |
| 433 | UNREFERENCED_PARAMETER(Flags); |
| 434 | UNREFERENCED_PARAMETER(VolumeDeviceType); |
| 435 | |
| 436 | status = FltIsVolumeWritable(FltObjects->Volume, |
| 437 | &isWritable); |
| 438 | |
| 439 | if (!NT_SUCCESS(status)) { |
| 440 | |
| 441 | return STATUS_FLT_DO_NOT_ATTACH; |
| 442 | } |
| 443 | |
| 444 | // |
| 445 | // If you can't write to a volume... how can you delete a file in it? |
| 446 | // |
| 447 | if (isWritable) { |
| 448 | |
| 449 | switch (VolumeFilesystemType) { |
| 450 | |
| 451 | case FLT_FSTYPE_NTFS: |
| 452 | case FLT_FSTYPE_REFS: |
| 453 | |
| 454 | status = STATUS_SUCCESS; |
| 455 | break; |
| 456 | |
| 457 | default: |
| 458 | |
| 459 | return STATUS_FLT_DO_NOT_ATTACH; |
| 460 | } |
| 461 | |
| 462 | } |
| 463 | else { |
| 464 | |
| 465 | return STATUS_FLT_DO_NOT_ATTACH; |
| 466 | } |
| 467 | |
| 468 | return status; |
| 469 | } |
| 470 | |
| 471 | |
| 472 | /** |
nothing calls this directly
no outgoing calls
no test coverage detected