Initiating Filtering

After calling FltRegisterFilter, a minifilter driver's DriverEntry routine typically calls FltStartFiltering to begin filtering I/O operations.

Every minifilter driver must call FltStartFiltering from its DriverEntry routine to notify the filter manager that the minifilter driver is ready to begin attaching to volumes and filtering I/O requests. After the minifilter driver calls FltStartFiltering, the filter manager treats the minifilter driver as a fully active minifilter driver, presenting it with I/O requests and notifications of volumes to attach to. The minifilter driver must be prepared to begin receiving these I/O requests and notifications even before FltStartFiltering returns.

In the MiniSpy sample driver, FltStartFiltering is called as shown in the following code example:

status = FltStartFiltering( MiniSpyData.FilterHandle );
if( !NT_SUCCESS( status )) {
  FltUnregisterFilter( MiniSpyData.FilterHandle );
}

If the call to FltStartFiltering does not return STATUS_SUCCESS, the minifilter driver must call FltUnregisterFilter to unregister itself.