CBMonitor Class

Properties   Methods   Events   Config Settings   Errors  

The CBMonitor class allows applications to monitor filesystem requests.

Syntax

class cbfsfilter.CBMonitor

Remarks

The CBMonitor class is a "monitoring-only" subset of the CBFilter class; it gives applications the ability to monitor filesystem requests, allowing them to be logged and reported. Applications use standard filter rules to specify which requests they are interested in monitoring.

To learn more about the class's capabilities, please refer to the product's General Information topics.

Getting Started

  1. If the class's system driver has not been installed yet, call the install method to do so. This needs to be done only once.
    • In production, the driver can be installed (or updated) ahead of time by the application's installation script using the Installer DLL. Please refer to the Driver Installation topic for more information.
  2. Call the initialize method to initialize the CBMonitor class. This must be done each time the application starts.
  3. Add one or more filter rules using methods like add_filter_rule. (Rules can also be added/removed after the filter is started.)
  4. Call the start_filter method to start monitoring filesystem requests.
  5. When finished, call the stop_filter method to stop monitoring filesystem requests.
  6. To uninstall the class's system driver, call the uninstall method. This should not be done as part of the driver upgrade process.
    • In production, the driver can be uninstalled by the application's uninstallation script using the Installer DLL. Please refer to the Driver Installation topic for more information.

Property List


The following is the full list of the properties of the class with short descriptions. Click on the links for further details.

activeThis property notes whether the class is active and processing requests.
altitudeThis property specifies the altitude the class's system driver should use .
filter_rule_countThe number of records in the FilterRule arrays.
filter_rule_access_flagsThis property indicates the access restrictions enforced by the rule (CBFilter only).
filter_rule_control_flagsThis property indicates which control events the rule causes the class to fire (CBFilter only).
filter_rule_ea_nameThis property indicates the name of an extended attribute that a file or directory must have to match the rule.
filter_rule_excluded_attributesThis property indicates the file attributes that a file or directory must not have to match the rule.
filter_rule_included_attributesThis property indicates the file attributes that a file or directory must have to match the rule.
filter_rule_maskThis property indicates a file mask that determines which files and directories match the rule.
filter_rule_max_sizeThis property indicates the maximum size a file can be to match the rule.
filter_rule_min_sizeThis property indicates the minimum size a file can be to match the rule.
filter_rule_notify_flagsThis property indicates which notification events the rule causes the class to fire.
fire_volume_eventsThis property specifies the events that should be fired when a filesystem volume is mounted to or unmounted from the system.
passthrough_rule_countThe number of records in the PassthroughRule arrays.
passthrough_rule_access_flagsThis property specifies the access restrictions lifted by the rule (CBFilter only).
passthrough_rule_control_flagsThis property indicates which control events the rule prevents the class from firing (CBFilter only).
passthrough_rule_ea_nameThis property indicates the name of an extended attribute that a file or directory must have to match the rule.
passthrough_rule_excluded_attributesThis property indicates the file attributes that a file or directory must not have to match the rule.
passthrough_rule_included_attributesThis property indicates the file attributes that a file or directory must have to match the rule.
passthrough_rule_maskThis property indicates a file mask that determines which files and directories match the rule.
passthrough_rule_max_sizeThis property indicates the maximum size a file can be to match the rule.
passthrough_rule_min_sizeThis property indicates the minimum size a file can be to match the rule.
passthrough_rule_notify_flagsThis property indicates which notification events the rule prevents the class from firing.
process_cached_io_requestsThis property specifies whether cached file read/write requests should be processed.
process_failed_requestsThis property specifies whether failed requests should be processed.
serialize_eventsWhether events should be fired on a single worker thread, or many.
tagThis property stores application-defined data specific to a particular instance of the class.

Method List


The following is the full list of the methods of the class with short descriptions. Click on the links for further details.

add_filter_ruleThis method adds a standard filter rule.
add_filter_rule_exThis method adds a standard filter rule with additional match qualifiers.
add_passthrough_ruleThis method adds a passthrough rule.
add_passthrough_rule_exThis method adds a passthrough rule with additional match qualifiers.
configSets or retrieves a configuration setting.
delete_all_filter_rulesThis method deletes all standard filter rules.
delete_all_passthrough_rulesThis method deletes all passthrough rules.
delete_filter_ruleThis method deletes a particular standard filter rule.
delete_passthrough_ruleThis method deletes a particular passthrough rule.
file_matches_maskThis method checks whether a particular file or directory name matches the specified mask.
get_dos_path_nameThis method retrieves the DOS path name of the file or directory by its native (NT) path.
get_driver_statusThis method retrieves the status of the class's system driver.
get_driver_versionThis method retrieves the version of the class's system driver.
get_event_filenameThis method retrieves the name of the file or directory, to which the event applies.
get_nt_path_nameThis method retrieves the NT (native) path name of the file or directory by its DOS path.
get_operation_timeThis method returns the time at which the request was received by the filter driver.
get_originator_process_idRetrieves the Id of the process (PID) that initiated the operation.
get_originator_process_nameRetrieves the name of the process that initiated the operation.
get_originator_thread_idRetrieves the Id of the thread that initiated the operation.
get_remote_access_informationThis method returns networking-related information about the operation.
get_volume_guidThis method retrieves the volume GUID of the device targeted by a filesystem operation.
initializeThis method initializes the class.
installThis method installs (or upgrades) the class's system driver.
nt_status_to_win_32_errorThis method converts a native status code to a Win32 error code.
shutdown_systemShuts down or reboots the operating system.
start_filterThis method starts filtering filesystem operations.
stop_filterThis method stops filtering filesystem operations.
uninstallThis method uninstalls the class's system driver.

Event List


The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.

on_after_filter_attach_to_volumeThis event fires after the filter attaches to a newly mounted filesystem volume.
on_after_filter_detach_from_volumeThis event fires after the filter detaches from a filesystem volume.
on_before_filter_attach_to_volumeThis event fires before the filter attaches to a newly mounted filesystem volume.
on_errorThis event fires if an unhandled error occurs during an event.
on_filter_startThis event fires once the filter has attached and filtering has started.
on_filter_stopThis event fires once filtering has stopped and the filter has detached.
on_notify_can_file_be_deletedThis event fires when the OS marks a file or directory for deletion or removes such a mark.
on_notify_cleanup_fileThis event fires when a file or directory handle has been closed.
on_notify_close_fileThis event fires when a file or directory has been closed.
on_notify_create_fileThis event fires when a file or directory has been created.
on_notify_create_hard_linkThis event fires when a hard link has been created.
on_notify_delete_fileThis event fires when a file or directory has been deleted.
on_notify_delete_reparse_pointThis event fires when a file or directory's reparse point has been deleted.
on_notify_enumerate_directoryThis event fires when a directory entry has been returned during directory enumeration.
on_notify_filter_attach_to_volumeThis event fires when the filter has been attached to a newly mounted filesystem volume.
on_notify_filter_detach_from_volumeThis event fires when the filter has been detached from a filesystem volume.
on_notify_fsctlThis event fires when an IRP_MJ_FILE_SYSTEM_CONTROL operation has occurred.
on_notify_get_file_securityThis event fires when a file or directory's security attributes have been retrieved.
on_notify_get_file_sizesThis event fires when a file's size information has been retrieved.
on_notify_get_reparse_pointThis event fires when a file or directory's reparse point information has been retrieved.
on_notify_ioctlThis event fires when an IRP_MJ_DEVICE_CONTROL operation has occurred.
on_notify_lockThis event fires when a range of bytes in a file has been locked.
on_notify_open_fileThis event fires when a file or directory has been opened.
on_notify_query_eaThis event fires when information about the extended attributes of a file has been retrieved.
on_notify_query_file_infoThis event fires when information about a file or directory has been retrieved.
on_notify_read_fileThis event fires when data have been read from a file.
on_notify_rename_or_move_fileThis event fires when a file or directory has been renamed or moved.
on_notify_set_allocation_sizeThis event fires when a file's allocation size has been changed.
on_notify_set_eaThis event fires when information about the extended attributes of a file has been changed.
on_notify_set_file_attributesThis event fires when a file or directory's attributes or times have been changed.
on_notify_set_file_infoThis event fires when information about a file or directory has been changed.
on_notify_set_file_securityThis event fires when a file or directory's security attributes have been changed.
on_notify_set_file_sizeThis event fires when a file has been resized.
on_notify_set_reparse_pointThis event fires when a file or directory's reparse point has been created or updated.
on_notify_unlock_allThis event fires when all locked byte ranges in a file have been unlocked.
on_notify_unlock_all_by_keyThis event fires when all locked byte ranges in a file, associated with a particular key, have been unlocked.
on_notify_unlock_singleThis event fires when a particular locked byte range in a file has been unlocked.
on_notify_write_fileThis event fires when data have been written to a file.
on_worker_thread_creationFires just after a new worker thread is created.
on_worker_thread_terminationFires just before a worker thread is terminated.

Config Settings


The following is a list of config settings for the class with short descriptions. Click on the links for further details.

AlwaysPrepareFilesWhether the driver should keep track of information for files that are already open when (i.e., were opened before) the class is initialized.
AlwaysRequestAttributesOnOpenWhether the driver should keep request existing attributes before file create/open operation.
CollectRemoteOpenInformationEnables collection of information about remote filesystem requests.
FilterOwnRequestsWhether the class's system driver should filter requests made by the application itself.
ForceAppPermissionCheckWhether the driver should require the controller process to have elevated or system privileges.
ForceSecurityChecksWhether the driver should prevent the controller process from filtering files that it would not normally have access to.
LoggingEnabledWhether extended logging is enabled.
MaxWorkerThreadCountThe maximum number of worker threads to use to fire events.
MinWorkerThreadCountThe minimum number of worker threads to use to fire events.
OmitEventFilenamesWhether the filename parameter should be empty in events.
PassSecurityInFileOpenEventsWhether security information, associated with the file create/open request, is passed to file creation and opening events.
PreprocessedRulesCacheSizeMaximum number of preprocessed rules to keep cached.
RecordOperationTimeEnables collection of operation time.
ResolveNtDeviceToDriveLetterWhether native device names are translated to drive letters.
SendRequestsViaDriverStackWhether internal requests to the filesystem are sent directly to the filesystem driver or through the stack of filesystem filter drivers.
WorkerInitialStackSizeThe initial stack size to create worker threads with.
BuildInfoInformation about the product's build.
LicenseInfoInformation about the current license.

active Property

This property notes whether the class is active and processing requests.

Syntax

def get_active() -> bool: ...

active = property(get_active, None)

Default Value

FALSE

Remarks

This property reflects whether the class is active and currently processing requests. It will be True after the filter has been attached successfully via a call to start_filter.

This property is read-only.

altitude Property

This property specifies the altitude the class's system driver should use .

Syntax

def get_altitude() -> str: ...
def set_altitude(value: str) -> None: ...

altitude = property(get_altitude, set_altitude)

Default Value

""

Remarks

This property specifies the altitude that the class's system driver should use . A driver's altitude determines its absolute position in the stack of filter drivers; drivers with higher altitudes are attached toward the top of the stack, closer to the user mode, which allows them to process requests earlier.

Microsoft manages and assigns filesystem minifilter driver altitudes directly, so an application-specific altitude value must be obtained from Microsoft before an application is deployed in production. Please refer to the Driver Altitudes topic for more information. During development, an appropriate arbitrary value, such as 360000 (which is not registered with Microsoft), can be used.

If this property is queried before an altitude has been set (via this property or the install method), it will return an empty string.

Note: This property cannot be changed when active is True. Additionally, the initialize method must be called before attempting to get or set this property's value, which is stored in the registry.

filter_rule_count Property

The number of records in the FilterRule arrays.

Syntax

def get_filter_rule_count() -> int: ...

filter_rule_count = property(get_filter_rule_count, None)

Default Value

0

Remarks

This property controls the size of the following arrays:

The array indices start at 0 and end at filter_rule_count - 1.

This property is read-only.

filter_rule_access_flags Property

This property indicates the access restrictions enforced by the rule (CBFilter only).

Syntax

def get_filter_rule_access_flags(filter_rule_index: int) -> int: ...

Default Value

0

Remarks

This property indicates the access restrictions enforced by the rule (CBFilter only).

This property indicates which access restrictions are enforced by the rule. Please refer to the Access Rules topic for more information. The value of this property is a combination of zero or more of the following:

ACCESS_NONE0x00No access restrictions.

ACCESS_READ_ONLY0x01Read-only access; writing and deleting are prohibited.

ACCESS_WRITE_ONLY0x02Write-only access; reading and deleting are prohibited.

ACCESS_DELETE_PROTECT0x04Deleting and renaming are prohibited.

ACCESS_EXECUTE_PROTECT0x08Execution is prohibited.

ACCESS_NO_CHANGE_DAC0x10Change of security attributes is prohibited.

ACCESS_NO_CHANGE_OWNER0x20Change of owner is prohibited.

ACCESS_RENAME_PROTECT0x40Renaming is prohibited.

ACCESS_DELETE_ONLY_PROTECT0x80Deleting is prohibited (renaming is not affected).

ACCESS_REMOTE_ACCESS_PROTECT0x100Access from other systems is prohibited.

ACCESS_DENY_ALL0x200All access is denied.

ACCESS_ALL_FLAGS-1Used to denote all currently set access restriction flags.

Note: This property is always 0 for the CBMonitor class, which does not support access rules.

The filter_rule_index parameter specifies the index of the item in the array. The size of the array is controlled by the filter_rule_count property.

This property is read-only.

filter_rule_control_flags Property

This property indicates which control events the rule causes the class to fire (CBFilter only).

Syntax

def get_filter_rule_control_flags(filter_rule_index: int) -> int: ...

Default Value

0

Remarks

This property indicates which control events the rule causes the class to fire (CBFilter only).

This property indicates which filesystem operations, of those performed on matching files and directories, the class should fire Control Events for. The value of this property is a combination of zero or more of the following:

FS_CE_NONE0Don't fire for any filesystem operations.

Control Events will not fire for any filesystem operations.

FS_CE_BEFORE_CREATE0x000000000001LFire before file creation operations.

The on_before_create_file event will fire anytime the OS attempts to create a file or directory. In some cases, this event can cause the on_before_open_file event to fire; refer to the File Create/Open Events topic for more information.

FS_CE_AFTER_CREATE0x000000000002LFire after file creation operations.

The on_after_create_file event will fire after a file or directory creation request has been processed, before the response is returned. In some cases, this event can cause the on_after_open_file event to fire; refer to the File Create/Open Events topic for more information.

FS_CE_BEFORE_OPEN0x000000000004LFire before file open operations.

The on_before_open_file event will fire anytime the OS attempts to open a file or directory. In some cases, this event can cause the on_before_create_file event to fire; refer to the File Create/Open Events topic for more information.

FS_CE_AFTER_OPEN0x000000000008LFire after file open operations.

The on_after_open_file event will fire after a file or directory open request has been processed, before the response is returned. In some cases, this event can cause the on_after_create_file event to fire; refer to the File Create/Open Events topic for more information.

FS_CE_BEFORE_READ0x000000000010LFire before read operations.

The on_before_read_file event will fire anytime the OS attempts to read data from a file.

FS_CE_AFTER_READ0x000000000020LFire after read operations.

The on_after_read_file event will fire after a read request has been processed, before the response is returned.

FS_CE_BEFORE_WRITE0x000000000040LFire before write operations.

The on_before_write_file event will fire anytime the OS attempts to write data to a file.

FS_CE_AFTER_WRITE0x000000000080LFire after write operations.

The on_after_read_file event will fire after a write request has been processed, before the response is returned.

FS_CE_BEFORE_LOCK_CONTROL0x000000000100LFire before lock and unlock operations.

The on_before_lock, on_before_unlock_all, on_before_unlock_all_by_key, and on_before_unlock_single events will fire, as applicable, before the OS attempts to lock or unlock a range of bytes in a file.

FS_CE_AFTER_LOCK_CONTROL0x000000000200LFire before and after lock and unlock operations.

The on_after_lock, on_after_unlock_all, on_after_unlock_all_by_key, and on_after_unlock_single, events will fire, as applicable, after a lock or unlock request has been processed, before the response is returned.

FS_CE_BEFORE_CLEANUP0x000000000400LFire before file handle cleanup operations.

The on_before_cleanup_file event will fire anytime a process closes a file or directory handle.

FS_CE_AFTER_CLEANUP0x000000000800LFire after file handle cleanup operations.

The on_after_cleanup_file event will fire after a file handle cleanup request has been processed, before the response is returned.

FS_CE_BEFORE_CLOSE0x000000001000LFire before file close operations.

The on_before_close_file event will fire anytime the OS closes a file or directory. Also, the on_after_close_enumeration event will fire anytime the OS closes a directory enumeration (which typically occurs immediately before the directory is closed).

FS_CE_AFTER_CLOSE0x000000002000LFire after file close operations.

The on_after_close_file event will fire after a file/directory close request has been processed, before the response is returned.

FS_CE_BEFORE_CAN_DELETE0x000000004000LFire before 'can be deleted' operations.

The on_before_can_file_be_deleted event will fire anytime the OS checks whether a file or directory can be deleted.

FS_CE_AFTER_CAN_DELETE0x000000008000LFire after 'can be deleted' operations.

The on_after_can_file_be_deleted event will fire after a can be deleted request has been processed, before the response is returned.

FS_CE_BEFORE_DELETE0x000000010000LFire before delete operations

The on_before_delete_file event will fire anytime the OS attempts to delete a file or directory.

FS_CE_AFTER_DELETE0x000000020000LFire after delete operations.

The on_after_delete_file event will fire after a delete request has been processed, before the response is returned.

FS_CE_BEFORE_RENAME0x000000040000LFire before rename/move operations.

The on_before_rename_or_move_file event will fire anytime the OS attempts to rename or move a file or directory.

FS_CE_AFTER_RENAME0x000000080000LFire after rename/move operations.

The on_after_rename_or_move_file event will fire after a rename or move request has been processed, before the response is returned.

FS_CE_BEFORE_GET_SECURITY0x000000100000LFire before get security operations.

The on_before_get_file_security event will fire before the OS queries the security attributes of a file or directory.

FS_CE_AFTER_GET_SECURITY0x000000200000LFire after get security operations.

The on_after_get_file_security events will fire after a get security operation has been processed, before the response is returned.

FS_CE_BEFORE_ENUMERATE_DIRECTORY0x000000400000LFire before directory enumeration operations.

The on_before_enumerate_directory event will fire anytime the OS needs to read information about directory entries.

FS_CE_AFTER_ENUMERATE_DIRECTORY0x000000800000LFire after directory enumeration operations.

The on_after_enumerate_directory event will fire after information about a directory entry has been retrieved during directory enumeration, before the response is returned.

FS_CE_BEFORE_QUERY_FILE_INFO0x000001000000LFire before 'query file information' operations.

The on_before_query_file_info event will fire anytime the OS needs to retrieve information about a file or directory.

FS_CE_AFTER_QUERY_FILE_INFO0x000002000000LFire after 'query file information' operations.

The on_after_query_file_info event will fire after a file or directory information query request has been processed, before the response is returned.

FS_CE_AFTER_GET_SIZES0x000008000000LFire after get size operations.

The on_after_get_file_sizes event will fire after a file's size information is retrieved, before the response is returned.

FS_CE_BEFORE_SET_SECURITY0x000010000000LFire before set security operations.

The on_before_set_file_security event will fire anytime the OS needs to change the security attributes of a file or directory.

FS_CE_AFTER_SET_SECURITY0x000020000000LFire after set security operations.

The on_after_set_file_security event will fire after a security attribute change request has been processed, before the response is returned.

FS_CE_BEFORE_SET_ATTRIBUTES0x000040000000LFire before file attribute update operations.

The on_before_set_file_attributes event will fire anytime the OS attempts to change the attributes of a file or directory.

FS_CE_AFTER_SET_ATTRIBUTES0x000080000000LFire after file attribute update operations.

The on_after_set_file_attributes event will fire after a file attribute change request has been processed, before the response is returned.

FS_CE_BEFORE_SET_SIZES0x000100000000LFire before file resize operations.

The on_before_set_file_size event will fire anytime the OS attempts to resize a file, and the on_before_set_allocation_size event will fire anytime the OS attempts to change a file's allocation size.

FS_CE_AFTER_SET_SIZES0x000200000000LFire after file resize operations.

The on_after_set_file_size event will fire after a file resize request has been processed, and the on_after_set_allocation_size event will fire after a file allocation size change request has been processed, before the response is returned.

FS_CE_BEFORE_CREATE_HARD_LINK0x000400000000LFire before hard link creation operations.

The on_before_create_hard_link event will fire anytime the OS attempts to create a hard link.

FS_CE_AFTER_CREATE_HARD_LINK0x000800000000LFire after hard link creation operations.

The on_after_create_hard_link events will fire after a hard link creation request has been processed, before the response is returned.

FS_CE_BEFORE_FSCTL0x001000000000LFire before FSCTL operations.

The on_before_fsctl event will fire anytime an IRP_MJ_FILE_SYSTEM_CONTROL request occurs.

FS_CE_AFTER_FSCTL0x002000000000LFire after FSCTL operations.

The on_after_fsctl event will fire after an IRP_MJ_FILE_SYSTEM_CONTROL request has been processed, before the response is returned.

FS_CE_BEFORE_IOCTL0x004000000000LFire before IOCTL operations.

The on_before_ioctl event will fire anytime an IRP_MJ_DEVICE_CONTROL request occurs.

FS_CE_AFTER_IOCTL0x008000000000LFire after IOCTL operations.

The on_after_ioctl event will fire after an IRP_MJ_DEVICE_CONTROL request has been processed, before the response is returned.

FS_CE_BEFORE_SET_FILE_INFO0x010000000000LFire before 'set file information' operations.

The on_before_set_file_info event will fire anytime the OS needs to change information about a file or directory.

FS_CE_AFTER_SET_FILE_INFO0x020000000000LFire after 'set file information' operations.

The on_after_set_file_info event will fire after a file or directory information change request has been processed, before the response is returned.

FS_CE_BEFORE_SET_EA0x040000000000LFire before Set Extended Attributes operations.

The on_before_set_ea event will fire anytime the OS needs to set extended attributes of a file.

FS_CE_AFTER_SET_EA0x080000000000LFire after Set Extended Attributes operations.

The on_after_set_ea event will fire after the OS request to set extended attributes of a file has been processed, before the response is returned.

FS_CE_BEFORE_QUERY_EA0x100000000000LFire before Query Extended Attributes operations.

The on_before_query_ea event will fire anytime the OS needs to retrieve extended attributes of a file.

FS_CE_AFTER_QUERY_EA0x200000000000LFire after Query Extended Attributes operations.

The on_after_query_ea event will fire after the OS request to retrieve extended attributes of a file has been processed, before the response is returned.

FS_CE_BEFORE_GET_REPARSE_POINT0x400000000000LFire before Get Reparse Point operations.

The on_before_get_reparse_point event will fire anytime the OS needs to read a reparse point of a file or directory.

FS_CE_AFTER_GET_REPARSE_POINT0x800000000000LFire after Get Reparse Point operations.

The on_after_get_reparse_point event will fire after the OS request to read a reparse point of a file or directory has been processed, before the response is returned.

FS_CE_BEFORE_SET_REPARSE_POINT0x1000000000000LFire before Set Reparse Point operations.

The on_before_set_reparse_point event will fire anytime the OS needs to set or update a reparse point for a file or directory.

FS_CE_AFTER_SET_REPARSE_POINT0x2000000000000LFire after Set Reparse Point operations.

The on_after_set_reparse_point event will fire after the OS request to set or update a reparse point for a file or directory has been processed, before the response is returned.

FS_CE_BEFORE_DELETE_REPARSE_POINT0x4000000000000LFire before Delete Reparse Point operations.

The on_before_delete_reparse_point event will fire anytime the OS needs to remove reparse point information from a file or directory.

FS_CE_AFTER_DELETE_REPARSE_POINT0x8000000000000LFire after Delete Reparse Point operations.

The on_after_delete_reparse_point event will fire after the OS request to remove reparse point information from a file or directory has been processed, before the response is returned.

FS_CE_REPARSE_FILENAME0x40000000000000LFire before various operations for the purpose of file redirection.

The on_reparse_file_name event will fire before any operation that includes a file or directory name, giving the application a chance to redirect it. This event is typically used when an application requires more advanced redirection logic than Reparse Rules can provide; please refer to that topic for more information.

FS_CE_REPARSE_TAG0x80000000000000LFire for reparse operations.

The on_reparse_with_tag event will fire anytime a file/directory open operation returns a STATUS_REPARSE result, allowing the application to handle the reparse point. Please refer to Microsoft's Reparse Points article for more information.

FS_CE_ALL-1Fire for all filesystem operations.

Control Events will fire for all filesystem operations that the class tracks.

Note: This property is always 0 for the CBMonitor class, which does not provide any Control Events for filesystem operations.

The filter_rule_index parameter specifies the index of the item in the array. The size of the array is controlled by the filter_rule_count property.

This property is read-only.

filter_rule_ea_name Property

This property indicates the name of an extended attribute that a file or directory must have to match the rule.

Syntax

def get_filter_rule_ea_name(filter_rule_index: int) -> str: ...

Default Value

""

Remarks

This property indicates the name of an extended attribute that a file or directory must have to match the rule.

This property reflects the name of an extended attribute that a file or directory must have to qualify as a match for the rule. A value of an empty string indicates that the rule does not use this property as a match qualifier.

The filter_rule_index parameter specifies the index of the item in the array. The size of the array is controlled by the filter_rule_count property.

This property is read-only.

filter_rule_excluded_attributes Property

This property indicates the file attributes that a file or directory must not have to match the rule.

Syntax

def get_filter_rule_excluded_attributes(filter_rule_index: int) -> int: ...

Default Value

0

Remarks

This property indicates the file attributes that a file or directory must not have to match the rule.

This property indicates which file attributes a file or directory must not have to qualify as a match for the rule. A value of 0 indicates that the rule does not use this property as a match qualifier.

The filter_rule_index parameter specifies the index of the item in the array. The size of the array is controlled by the filter_rule_count property.

This property is read-only.

filter_rule_included_attributes Property

This property indicates the file attributes that a file or directory must have to match the rule.

Syntax

def get_filter_rule_included_attributes(filter_rule_index: int) -> int: ...

Default Value

0

Remarks

This property indicates the file attributes that a file or directory must have to match the rule.

This property indicates which file attributes a file or directory must have to qualify as a match for the rule. A value of 0 indicates that the rule does not use this property as a match qualifier.

The filter_rule_index parameter specifies the index of the item in the array. The size of the array is controlled by the filter_rule_count property.

This property is read-only.

filter_rule_mask Property

This property indicates a file mask that determines which files and directories match the rule.

Syntax

def get_filter_rule_mask(filter_rule_index: int) -> str: ...

Default Value

""

Remarks

This property indicates a file mask that determines which files and directories match the rule.

This property reflects the file mask used to determine whether a file or directory matches the rule. In addition to being its primary match qualifier, a rule's mask also serves as its identifier; every rule in a ruleset must have a unique mask.

Note: When a rule with a drive letter is added, said drive letter is automatically converted to NT Device format. When the ResolveNtDeviceToDriveLetter configuration setting is disabled, this property's value will contain the NT Device name. When the ResolveNtDeviceToDriveLetter configuration setting is enabled, the class attempts to convert the mask back to the DOS format with a drive letter. In some situations, such backward conversion can lead to a path that was different from the original path added.

The filter_rule_index parameter specifies the index of the item in the array. The size of the array is controlled by the filter_rule_count property.

This property is read-only.

filter_rule_max_size Property

This property indicates the maximum size a file can be to match the rule.

Syntax

def get_filter_rule_max_size(filter_rule_index: int) -> int: ...

Default Value

0

Remarks

This property indicates the maximum size a file can be to match the rule.

This property indicates the maximum size, in bytes, that a file can be to qualify as a match for the rule. A value of -1 indicates that the rule does not use this property as a match qualifier.

The filter_rule_index parameter specifies the index of the item in the array. The size of the array is controlled by the filter_rule_count property.

This property is read-only.

filter_rule_min_size Property

This property indicates the minimum size a file can be to match the rule.

Syntax

def get_filter_rule_min_size(filter_rule_index: int) -> int: ...

Default Value

0

Remarks

This property indicates the minimum size a file can be to match the rule.

This property indicates the minimum size, in bytes, that a file can be to qualify as a match for the rule. A value of -1 indicates that the rule does not use this property as a match qualifier.

The filter_rule_index parameter specifies the index of the item in the array. The size of the array is controlled by the filter_rule_count property.

This property is read-only.

filter_rule_notify_flags Property

This property indicates which notification events the rule causes the class to fire.

Syntax

def get_filter_rule_notify_flags(filter_rule_index: int) -> int: ...

Default Value

0

Remarks

This property indicates which notification events the rule causes the class to fire.

This property indicates which filesystem operations, of those performed on matching files and directories, the class should fire Notification Events for. The value of this property is a combination of zero or more of the following:

FS_NE_NONE0Don't fire for any filesystem operations.

Notification Events will not fire for any filesystem operations.

FS_NE_CREATE0x00000001LFire for file creation operations.

The on_notify_create_file event will fire anytime the OS creates a file or directory. In some cases, this event can cause the on_notify_open_file event to fire; refer to the File Create/Open Events topic for more information.

FS_NE_OPEN0x00000002LFire for file open operations.

The on_notify_open_file event will fire anytime the OS opens a file or directory. In some cases, this event can cause the on_notify_create_file event to fire; refer to the File Create/Open Events topic for more information.

FS_NE_READ0x00000004LFire for read operations.

The on_notify_read_file event will fire anytime the OS reads data from a file.

FS_NE_WRITE0x00000008LFire for write operations.

The on_notify_write_file event will fire anytime the OS writes data to a file.

FS_NE_LOCK_CONTROL0x00000010LFire for lock and unlock operations.

The on_notify_lock, on_notify_unlock_all, on_notify_unlock_all_by_key, and on_notify_unlock_single events will fire, as applicable, anytime the OS locks or unlocks a range of bytes in a file.

FS_NE_CLEANUP0x00000020LFire for file handle cleanup operations.

The on_notify_cleanup_file event will fire anytime a process closes a file or directory handle.

FS_NE_CLOSE0x00000040LFire for file close operations.

The on_notify_close_file event will fire anytime the OS closes a file or directory.

FS_NE_CAN_DELETE0x00000080LFire for 'can be deleted' operations.

The on_notify_can_file_be_deleted event will fire anytime the OS checks whether or not a file or directory can be deleted.

FS_NE_DELETE0x00000100LFire for delete operations.

The on_notify_delete_file event will fire anytime the OS deletes a file or directory.

FS_NE_RENAME0x00000200LFire for rename/move operations.

The on_notify_rename_or_move_file event will fire anytime the OS renames or moves a file or directory.

FS_NE_GET_SECURITY0x00000400LFire for get security operations.

The on_notify_get_file_security event will fire anytime the OS queries the security attributes of a file or directory.

FS_NE_ENUMERATE_DIRECTORY0x00000800LFire for directory enumeration operations.

The on_notify_enumerate_directory event will fire anytime the OS retrieves a directory entry during directory enumeration.

FS_NE_QUERY_FILE_INFO0x00001000LFire for QueryFileInformation operations.

The on_notify_query_file_info event will fire anytime the OS retrieves information about a file or directory.

FS_NE_GET_SIZES0x00002000LFire for get size operations.

The on_notify_get_file_sizes event will fire anytime the OS retrieves a file's size information.

FS_NE_SET_SECURITY0x00004000LFire for set security operations.

The on_notify_set_file_security event will fire anytime the OS changes the security attributes of a file or directory.

FS_NE_SET_ATTRIBUTES0x00008000LFire for file attribute update operations.

The on_notify_set_file_attributes event will fire anytime the OS changes the attributes of a file or directory.

FS_NE_SET_SIZES0x00010000LFire for file resize operations.

The on_notify_set_file_size event will fire anytime the OS resizes a file, and the on_notify_set_allocation_size event will fire anytime the OS changes a file's allocation size.

FS_NE_CREATE_HARD_LINK0x00020000LFire for hard link creation operations.

The on_notify_create_hard_link event will fire anytime the OS creates a hard link.

FS_NE_FSCTL0x00040000LFire for FSCTL operations.

The on_notify_fsctl event will fire anytime an IRP_MJ_FILE_SYSTEM_CONTROL operation occurs.

FS_NE_IOCTL0x00080000LFire for IOCTL operations.

The on_notify_ioctl event will fire anytime an IRP_MJ_DEVICE_CONTROL operation occurs.

FS_NE_SET_FILE_INFO0x00100000LFire for SetFileInformation operations.

The on_notify_set_file_info event will fire anytime the OS changes information about a file or directory.

FS_NE_SET_EA0x00200000LFire for Set Extended Attributes operations.

The on_notify_set_ea event will fire anytime the OS sets extended attributes of a file.

FS_NE_QUERY_EA0x00400000LFire for Query Extended Attributes operations.

The on_notify_query_ea event will fire anytime the OS retrieves extended attributes of a file.

FS_NE_GET_REPARSE_POINT0x00800000LFire for Get Reparse Point operations.

The on_notify_get_reparse_point event will fire anytime the OS reads reparse point information of a file or directory.

FS_NE_SET_REPARSE_POINT0x01000000LFire for Set Reparse Point operations.

The on_notify_set_reparse_point event will fire anytime the OS sets or updates reparse point information for a file or directory.

FS_NE_DELETE_REPARSE_POINT0x02000000LFire for Delete Reparse Point operations.

The on_notify_delete_reparse_point event will fire anytime the OS deletes reparse point information from a file or directory.

FS_NE_ALL-1Fire for all filesystem operations.

Notification Events will fire for all filesystem operations that the class tracks.

The filter_rule_index parameter specifies the index of the item in the array. The size of the array is controlled by the filter_rule_count property.

This property is read-only.

fire_volume_events Property

This property specifies the events that should be fired when a filesystem volume is mounted to or unmounted from the system.

Syntax

def get_fire_volume_events() -> int: ...
def set_fire_volume_events(value: int) -> None: ...

fire_volume_events = property(get_fire_volume_events, set_fire_volume_events)

Default Value

0

Remarks

This property specifies the events that the class should fire when a filesystem volume is mounted to or unmounted from the system. Possible values are as follows:

FS_MOUNT_IGNORE0Don't fire any events when volumes are mounted or unmounted.

FS_MOUNT_NOTIFY64Fire Notification Events when volumes are mounted or unmounted.

The on_notify_filter_attach_to_volume and on_notify_filter_detach_from_volume events will fire, asynchronously, as necessary.

FS_MOUNT_CONTROL128Fire Control Events when volumes are mounted or unmounted.

The on_before_filter_attach_to_volume, on_after_filter_attach_to_volume, and on_after_filter_detach_from_volume events will fire, synchronously, as necessary.

FS_MOUNT_BOTH192Fire all events when volumes are mounted or unmounted.

Note: The aforementioned events are fired only for volumes mounted/unmounted after the start_filter method is called. Typically, applications use these events to dynamically add or remove volume-specific filter rules that target removable volumes (e.g., USB drives) as well as to create virtual files on such volumes. Please refer to the File Masks topic for more information.

passthrough_rule_count Property

The number of records in the PassthroughRule arrays.

Syntax

def get_passthrough_rule_count() -> int: ...

passthrough_rule_count = property(get_passthrough_rule_count, None)

Default Value

0

Remarks

This property controls the size of the following arrays:

The array indices start at 0 and end at passthrough_rule_count - 1.

This property is read-only.

passthrough_rule_access_flags Property

This property specifies the access restrictions lifted by the rule (CBFilter only).

Syntax

def get_passthrough_rule_access_flags(passthrough_rule_index: int) -> int: ...

Default Value

0

Remarks

This property specifies the access restrictions lifted by the rule (CBFilter only).

This property indicates which access restrictions are lifted by the rule. Please refer to the Passthrough Rules topic for more information. The value of this property is a combination of zero or more of the following:

ACCESS_NONE0x00No access restrictions.

ACCESS_READ_ONLY0x01Read-only access; writing and deleting are prohibited.

ACCESS_WRITE_ONLY0x02Write-only access; reading and deleting are prohibited.

ACCESS_DELETE_PROTECT0x04Deleting and renaming are prohibited.

ACCESS_EXECUTE_PROTECT0x08Execution is prohibited.

ACCESS_NO_CHANGE_DAC0x10Change of security attributes is prohibited.

ACCESS_NO_CHANGE_OWNER0x20Change of owner is prohibited.

ACCESS_RENAME_PROTECT0x40Renaming is prohibited.

ACCESS_DELETE_ONLY_PROTECT0x80Deleting is prohibited (renaming is not affected).

ACCESS_REMOTE_ACCESS_PROTECT0x100Access from other systems is prohibited.

ACCESS_DENY_ALL0x200All access is denied.

ACCESS_ALL_FLAGS-1Used to denote all currently set access restriction flags.

Note: This property is always 0 for the CBMonitor class, which does not support access rules.

The passthrough_rule_index parameter specifies the index of the item in the array. The size of the array is controlled by the passthrough_rule_count property.

This property is read-only.

passthrough_rule_control_flags Property

This property indicates which control events the rule prevents the class from firing (CBFilter only).

Syntax

def get_passthrough_rule_control_flags(passthrough_rule_index: int) -> int: ...

Default Value

0

Remarks

This property indicates which control events the rule prevents the class from firing (CBFilter only).

This property indicates which filesystem operations, of those performed on matching files and directories, the class should not fire Control Events for. Please refer to the Passthrough Rules topic for more information. The value of this property is a combination of zero or more of the following:

FS_CE_NONE0Don't fire for any filesystem operations.

Control Events will not fire for any filesystem operations.

FS_CE_BEFORE_CREATE0x000000000001LFire before file creation operations.

The on_before_create_file event will fire anytime the OS attempts to create a file or directory. In some cases, this event can cause the on_before_open_file event to fire; refer to the File Create/Open Events topic for more information.

FS_CE_AFTER_CREATE0x000000000002LFire after file creation operations.

The on_after_create_file event will fire after a file or directory creation request has been processed, before the response is returned. In some cases, this event can cause the on_after_open_file event to fire; refer to the File Create/Open Events topic for more information.

FS_CE_BEFORE_OPEN0x000000000004LFire before file open operations.

The on_before_open_file event will fire anytime the OS attempts to open a file or directory. In some cases, this event can cause the on_before_create_file event to fire; refer to the File Create/Open Events topic for more information.

FS_CE_AFTER_OPEN0x000000000008LFire after file open operations.

The on_after_open_file event will fire after a file or directory open request has been processed, before the response is returned. In some cases, this event can cause the on_after_create_file event to fire; refer to the File Create/Open Events topic for more information.

FS_CE_BEFORE_READ0x000000000010LFire before read operations.

The on_before_read_file event will fire anytime the OS attempts to read data from a file.

FS_CE_AFTER_READ0x000000000020LFire after read operations.

The on_after_read_file event will fire after a read request has been processed, before the response is returned.

FS_CE_BEFORE_WRITE0x000000000040LFire before write operations.

The on_before_write_file event will fire anytime the OS attempts to write data to a file.

FS_CE_AFTER_WRITE0x000000000080LFire after write operations.

The on_after_read_file event will fire after a write request has been processed, before the response is returned.

FS_CE_BEFORE_LOCK_CONTROL0x000000000100LFire before lock and unlock operations.

The on_before_lock, on_before_unlock_all, on_before_unlock_all_by_key, and on_before_unlock_single events will fire, as applicable, before the OS attempts to lock or unlock a range of bytes in a file.

FS_CE_AFTER_LOCK_CONTROL0x000000000200LFire before and after lock and unlock operations.

The on_after_lock, on_after_unlock_all, on_after_unlock_all_by_key, and on_after_unlock_single, events will fire, as applicable, after a lock or unlock request has been processed, before the response is returned.

FS_CE_BEFORE_CLEANUP0x000000000400LFire before file handle cleanup operations.

The on_before_cleanup_file event will fire anytime a process closes a file or directory handle.

FS_CE_AFTER_CLEANUP0x000000000800LFire after file handle cleanup operations.

The on_after_cleanup_file event will fire after a file handle cleanup request has been processed, before the response is returned.

FS_CE_BEFORE_CLOSE0x000000001000LFire before file close operations.

The on_before_close_file event will fire anytime the OS closes a file or directory. Also, the on_after_close_enumeration event will fire anytime the OS closes a directory enumeration (which typically occurs immediately before the directory is closed).

FS_CE_AFTER_CLOSE0x000000002000LFire after file close operations.

The on_after_close_file event will fire after a file/directory close request has been processed, before the response is returned.

FS_CE_BEFORE_CAN_DELETE0x000000004000LFire before 'can be deleted' operations.

The on_before_can_file_be_deleted event will fire anytime the OS checks whether a file or directory can be deleted.

FS_CE_AFTER_CAN_DELETE0x000000008000LFire after 'can be deleted' operations.

The on_after_can_file_be_deleted event will fire after a can be deleted request has been processed, before the response is returned.

FS_CE_BEFORE_DELETE0x000000010000LFire before delete operations

The on_before_delete_file event will fire anytime the OS attempts to delete a file or directory.

FS_CE_AFTER_DELETE0x000000020000LFire after delete operations.

The on_after_delete_file event will fire after a delete request has been processed, before the response is returned.

FS_CE_BEFORE_RENAME0x000000040000LFire before rename/move operations.

The on_before_rename_or_move_file event will fire anytime the OS attempts to rename or move a file or directory.

FS_CE_AFTER_RENAME0x000000080000LFire after rename/move operations.

The on_after_rename_or_move_file event will fire after a rename or move request has been processed, before the response is returned.

FS_CE_BEFORE_GET_SECURITY0x000000100000LFire before get security operations.

The on_before_get_file_security event will fire before the OS queries the security attributes of a file or directory.

FS_CE_AFTER_GET_SECURITY0x000000200000LFire after get security operations.

The on_after_get_file_security events will fire after a get security operation has been processed, before the response is returned.

FS_CE_BEFORE_ENUMERATE_DIRECTORY0x000000400000LFire before directory enumeration operations.

The on_before_enumerate_directory event will fire anytime the OS needs to read information about directory entries.

FS_CE_AFTER_ENUMERATE_DIRECTORY0x000000800000LFire after directory enumeration operations.

The on_after_enumerate_directory event will fire after information about a directory entry has been retrieved during directory enumeration, before the response is returned.

FS_CE_BEFORE_QUERY_FILE_INFO0x000001000000LFire before 'query file information' operations.

The on_before_query_file_info event will fire anytime the OS needs to retrieve information about a file or directory.

FS_CE_AFTER_QUERY_FILE_INFO0x000002000000LFire after 'query file information' operations.

The on_after_query_file_info event will fire after a file or directory information query request has been processed, before the response is returned.

FS_CE_AFTER_GET_SIZES0x000008000000LFire after get size operations.

The on_after_get_file_sizes event will fire after a file's size information is retrieved, before the response is returned.

FS_CE_BEFORE_SET_SECURITY0x000010000000LFire before set security operations.

The on_before_set_file_security event will fire anytime the OS needs to change the security attributes of a file or directory.

FS_CE_AFTER_SET_SECURITY0x000020000000LFire after set security operations.

The on_after_set_file_security event will fire after a security attribute change request has been processed, before the response is returned.

FS_CE_BEFORE_SET_ATTRIBUTES0x000040000000LFire before file attribute update operations.

The on_before_set_file_attributes event will fire anytime the OS attempts to change the attributes of a file or directory.

FS_CE_AFTER_SET_ATTRIBUTES0x000080000000LFire after file attribute update operations.

The on_after_set_file_attributes event will fire after a file attribute change request has been processed, before the response is returned.

FS_CE_BEFORE_SET_SIZES0x000100000000LFire before file resize operations.

The on_before_set_file_size event will fire anytime the OS attempts to resize a file, and the on_before_set_allocation_size event will fire anytime the OS attempts to change a file's allocation size.

FS_CE_AFTER_SET_SIZES0x000200000000LFire after file resize operations.

The on_after_set_file_size event will fire after a file resize request has been processed, and the on_after_set_allocation_size event will fire after a file allocation size change request has been processed, before the response is returned.

FS_CE_BEFORE_CREATE_HARD_LINK0x000400000000LFire before hard link creation operations.

The on_before_create_hard_link event will fire anytime the OS attempts to create a hard link.

FS_CE_AFTER_CREATE_HARD_LINK0x000800000000LFire after hard link creation operations.

The on_after_create_hard_link events will fire after a hard link creation request has been processed, before the response is returned.

FS_CE_BEFORE_FSCTL0x001000000000LFire before FSCTL operations.

The on_before_fsctl event will fire anytime an IRP_MJ_FILE_SYSTEM_CONTROL request occurs.

FS_CE_AFTER_FSCTL0x002000000000LFire after FSCTL operations.

The on_after_fsctl event will fire after an IRP_MJ_FILE_SYSTEM_CONTROL request has been processed, before the response is returned.

FS_CE_BEFORE_IOCTL0x004000000000LFire before IOCTL operations.

The on_before_ioctl event will fire anytime an IRP_MJ_DEVICE_CONTROL request occurs.

FS_CE_AFTER_IOCTL0x008000000000LFire after IOCTL operations.

The on_after_ioctl event will fire after an IRP_MJ_DEVICE_CONTROL request has been processed, before the response is returned.

FS_CE_BEFORE_SET_FILE_INFO0x010000000000LFire before 'set file information' operations.

The on_before_set_file_info event will fire anytime the OS needs to change information about a file or directory.

FS_CE_AFTER_SET_FILE_INFO0x020000000000LFire after 'set file information' operations.

The on_after_set_file_info event will fire after a file or directory information change request has been processed, before the response is returned.

FS_CE_BEFORE_SET_EA0x040000000000LFire before Set Extended Attributes operations.

The on_before_set_ea event will fire anytime the OS needs to set extended attributes of a file.

FS_CE_AFTER_SET_EA0x080000000000LFire after Set Extended Attributes operations.

The on_after_set_ea event will fire after the OS request to set extended attributes of a file has been processed, before the response is returned.

FS_CE_BEFORE_QUERY_EA0x100000000000LFire before Query Extended Attributes operations.

The on_before_query_ea event will fire anytime the OS needs to retrieve extended attributes of a file.

FS_CE_AFTER_QUERY_EA0x200000000000LFire after Query Extended Attributes operations.

The on_after_query_ea event will fire after the OS request to retrieve extended attributes of a file has been processed, before the response is returned.

FS_CE_BEFORE_GET_REPARSE_POINT0x400000000000LFire before Get Reparse Point operations.

The on_before_get_reparse_point event will fire anytime the OS needs to read a reparse point of a file or directory.

FS_CE_AFTER_GET_REPARSE_POINT0x800000000000LFire after Get Reparse Point operations.

The on_after_get_reparse_point event will fire after the OS request to read a reparse point of a file or directory has been processed, before the response is returned.

FS_CE_BEFORE_SET_REPARSE_POINT0x1000000000000LFire before Set Reparse Point operations.

The on_before_set_reparse_point event will fire anytime the OS needs to set or update a reparse point for a file or directory.

FS_CE_AFTER_SET_REPARSE_POINT0x2000000000000LFire after Set Reparse Point operations.

The on_after_set_reparse_point event will fire after the OS request to set or update a reparse point for a file or directory has been processed, before the response is returned.

FS_CE_BEFORE_DELETE_REPARSE_POINT0x4000000000000LFire before Delete Reparse Point operations.

The on_before_delete_reparse_point event will fire anytime the OS needs to remove reparse point information from a file or directory.

FS_CE_AFTER_DELETE_REPARSE_POINT0x8000000000000LFire after Delete Reparse Point operations.

The on_after_delete_reparse_point event will fire after the OS request to remove reparse point information from a file or directory has been processed, before the response is returned.

FS_CE_REPARSE_FILENAME0x40000000000000LFire before various operations for the purpose of file redirection.

The on_reparse_file_name event will fire before any operation that includes a file or directory name, giving the application a chance to redirect it. This event is typically used when an application requires more advanced redirection logic than Reparse Rules can provide; please refer to that topic for more information.

FS_CE_REPARSE_TAG0x80000000000000LFire for reparse operations.

The on_reparse_with_tag event will fire anytime a file/directory open operation returns a STATUS_REPARSE result, allowing the application to handle the reparse point. Please refer to Microsoft's Reparse Points article for more information.

FS_CE_ALL-1Fire for all filesystem operations.

Control Events will fire for all filesystem operations that the class tracks.

Note: This property is always 0 for the CBMonitor class, which does not provide any Control Events for filesystem operations.

The passthrough_rule_index parameter specifies the index of the item in the array. The size of the array is controlled by the passthrough_rule_count property.

This property is read-only.

passthrough_rule_ea_name Property

This property indicates the name of an extended attribute that a file or directory must have to match the rule.

Syntax

def get_passthrough_rule_ea_name(passthrough_rule_index: int) -> str: ...

Default Value

""

Remarks

This property indicates the name of an extended attribute that a file or directory must have to match the rule.

This property reflects the name of an extended attribute that a file or directory must have to qualify as a match for the rule. A value of an empty string indicates that the rule does not use this property as a match qualifier.

The passthrough_rule_index parameter specifies the index of the item in the array. The size of the array is controlled by the passthrough_rule_count property.

This property is read-only.

passthrough_rule_excluded_attributes Property

This property indicates the file attributes that a file or directory must not have to match the rule.

Syntax

def get_passthrough_rule_excluded_attributes(passthrough_rule_index: int) -> int: ...

Default Value

0

Remarks

This property indicates the file attributes that a file or directory must not have to match the rule.

This property indicates which file attributes a file or directory must not have to qualify as a match for the rule. A value of 0 indicates that the rule does not use this property as a match qualifier.

The passthrough_rule_index parameter specifies the index of the item in the array. The size of the array is controlled by the passthrough_rule_count property.

This property is read-only.

passthrough_rule_included_attributes Property

This property indicates the file attributes that a file or directory must have to match the rule.

Syntax

def get_passthrough_rule_included_attributes(passthrough_rule_index: int) -> int: ...

Default Value

0

Remarks

This property indicates the file attributes that a file or directory must have to match the rule.

This property indicates which file attributes a file or directory must have to qualify as a match for the rule. A value of 0 indicates that the rule does not use this property as a match qualifier.

The passthrough_rule_index parameter specifies the index of the item in the array. The size of the array is controlled by the passthrough_rule_count property.

This property is read-only.

passthrough_rule_mask Property

This property indicates a file mask that determines which files and directories match the rule.

Syntax

def get_passthrough_rule_mask(passthrough_rule_index: int) -> str: ...

Default Value

""

Remarks

This property indicates a file mask that determines which files and directories match the rule.

This property reflects the file mask used to determine whether a file or directory matches the rule. In addition to being its primary match qualifier, a rule's mask also serves as its identifier; every rule in a ruleset must have a unique mask.

Note: When a rule with a drive letter is added, said drive letter is automatically converted to NT Device format. When the ResolveNtDeviceToDriveLetter configuration setting is disabled, this property's value will contain the NT Device name. When the ResolveNtDeviceToDriveLetter configuration setting is enabled, the class attempts to convert the mask back to the DOS format with a drive letter. In some situations, such backward conversion can lead to a path that was different from the original path added.

The passthrough_rule_index parameter specifies the index of the item in the array. The size of the array is controlled by the passthrough_rule_count property.

This property is read-only.

passthrough_rule_max_size Property

This property indicates the maximum size a file can be to match the rule.

Syntax

def get_passthrough_rule_max_size(passthrough_rule_index: int) -> int: ...

Default Value

0

Remarks

This property indicates the maximum size a file can be to match the rule.

This property indicates the maximum size, in bytes, that a file can be to qualify as a match for the rule. A value of -1 indicates that the rule does not use this property as a match qualifier.

The passthrough_rule_index parameter specifies the index of the item in the array. The size of the array is controlled by the passthrough_rule_count property.

This property is read-only.

passthrough_rule_min_size Property

This property indicates the minimum size a file can be to match the rule.

Syntax

def get_passthrough_rule_min_size(passthrough_rule_index: int) -> int: ...

Default Value

0

Remarks

This property indicates the minimum size a file can be to match the rule.

This property indicates the minimum size, in bytes, that a file can be to qualify as a match for the rule. A value of -1 indicates that the rule does not use this property as a match qualifier.

The passthrough_rule_index parameter specifies the index of the item in the array. The size of the array is controlled by the passthrough_rule_count property.

This property is read-only.

passthrough_rule_notify_flags Property

This property indicates which notification events the rule prevents the class from firing.

Syntax

def get_passthrough_rule_notify_flags(passthrough_rule_index: int) -> int: ...

Default Value

0

Remarks

This property indicates which notification events the rule prevents the class from firing.

This property indicates which filesystem operations, of those performed on matching files and directories, the class should not fire Notification Events for. Please refer to the Passthrough Rules topic for more information. The value of this property is a combination of zero or more of the following:

FS_NE_NONE0Don't fire for any filesystem operations.

Notification Events will not fire for any filesystem operations.

FS_NE_CREATE0x00000001LFire for file creation operations.

The on_notify_create_file event will fire anytime the OS creates a file or directory. In some cases, this event can cause the on_notify_open_file event to fire; refer to the File Create/Open Events topic for more information.

FS_NE_OPEN0x00000002LFire for file open operations.

The on_notify_open_file event will fire anytime the OS opens a file or directory. In some cases, this event can cause the on_notify_create_file event to fire; refer to the File Create/Open Events topic for more information.

FS_NE_READ0x00000004LFire for read operations.

The on_notify_read_file event will fire anytime the OS reads data from a file.

FS_NE_WRITE0x00000008LFire for write operations.

The on_notify_write_file event will fire anytime the OS writes data to a file.

FS_NE_LOCK_CONTROL0x00000010LFire for lock and unlock operations.

The on_notify_lock, on_notify_unlock_all, on_notify_unlock_all_by_key, and on_notify_unlock_single events will fire, as applicable, anytime the OS locks or unlocks a range of bytes in a file.

FS_NE_CLEANUP0x00000020LFire for file handle cleanup operations.

The on_notify_cleanup_file event will fire anytime a process closes a file or directory handle.

FS_NE_CLOSE0x00000040LFire for file close operations.

The on_notify_close_file event will fire anytime the OS closes a file or directory.

FS_NE_CAN_DELETE0x00000080LFire for 'can be deleted' operations.

The on_notify_can_file_be_deleted event will fire anytime the OS checks whether or not a file or directory can be deleted.

FS_NE_DELETE0x00000100LFire for delete operations.

The on_notify_delete_file event will fire anytime the OS deletes a file or directory.

FS_NE_RENAME0x00000200LFire for rename/move operations.

The on_notify_rename_or_move_file event will fire anytime the OS renames or moves a file or directory.

FS_NE_GET_SECURITY0x00000400LFire for get security operations.

The on_notify_get_file_security event will fire anytime the OS queries the security attributes of a file or directory.

FS_NE_ENUMERATE_DIRECTORY0x00000800LFire for directory enumeration operations.

The on_notify_enumerate_directory event will fire anytime the OS retrieves a directory entry during directory enumeration.

FS_NE_QUERY_FILE_INFO0x00001000LFire for QueryFileInformation operations.

The on_notify_query_file_info event will fire anytime the OS retrieves information about a file or directory.

FS_NE_GET_SIZES0x00002000LFire for get size operations.

The on_notify_get_file_sizes event will fire anytime the OS retrieves a file's size information.

FS_NE_SET_SECURITY0x00004000LFire for set security operations.

The on_notify_set_file_security event will fire anytime the OS changes the security attributes of a file or directory.

FS_NE_SET_ATTRIBUTES0x00008000LFire for file attribute update operations.

The on_notify_set_file_attributes event will fire anytime the OS changes the attributes of a file or directory.

FS_NE_SET_SIZES0x00010000LFire for file resize operations.

The on_notify_set_file_size event will fire anytime the OS resizes a file, and the on_notify_set_allocation_size event will fire anytime the OS changes a file's allocation size.

FS_NE_CREATE_HARD_LINK0x00020000LFire for hard link creation operations.

The on_notify_create_hard_link event will fire anytime the OS creates a hard link.

FS_NE_FSCTL0x00040000LFire for FSCTL operations.

The on_notify_fsctl event will fire anytime an IRP_MJ_FILE_SYSTEM_CONTROL operation occurs.

FS_NE_IOCTL0x00080000LFire for IOCTL operations.

The on_notify_ioctl event will fire anytime an IRP_MJ_DEVICE_CONTROL operation occurs.

FS_NE_SET_FILE_INFO0x00100000LFire for SetFileInformation operations.

The on_notify_set_file_info event will fire anytime the OS changes information about a file or directory.

FS_NE_SET_EA0x00200000LFire for Set Extended Attributes operations.

The on_notify_set_ea event will fire anytime the OS sets extended attributes of a file.

FS_NE_QUERY_EA0x00400000LFire for Query Extended Attributes operations.

The on_notify_query_ea event will fire anytime the OS retrieves extended attributes of a file.

FS_NE_GET_REPARSE_POINT0x00800000LFire for Get Reparse Point operations.

The on_notify_get_reparse_point event will fire anytime the OS reads reparse point information of a file or directory.

FS_NE_SET_REPARSE_POINT0x01000000LFire for Set Reparse Point operations.

The on_notify_set_reparse_point event will fire anytime the OS sets or updates reparse point information for a file or directory.

FS_NE_DELETE_REPARSE_POINT0x02000000LFire for Delete Reparse Point operations.

The on_notify_delete_reparse_point event will fire anytime the OS deletes reparse point information from a file or directory.

FS_NE_ALL-1Fire for all filesystem operations.

Notification Events will fire for all filesystem operations that the class tracks.

The passthrough_rule_index parameter specifies the index of the item in the array. The size of the array is controlled by the passthrough_rule_count property.

This property is read-only.

process_cached_io_requests Property

This property specifies whether cached file read/write requests should be processed.

Syntax

def get_process_cached_io_requests() -> bool: ...
def set_process_cached_io_requests(value: bool) -> None: ...

process_cached_io_requests = property(get_process_cached_io_requests, set_process_cached_io_requests)

Default Value

FALSE

Remarks

This property specifies whether the class's system driver should process cached file read/write requests (i.e., fire *ReadFile and *WriteFile events for them). Please refer to the Cached and Non-Cached Requests topic for more information.

Note: This property cannot be changed when active is True.

process_failed_requests Property

This property specifies whether failed requests should be processed.

Syntax

def get_process_failed_requests() -> bool: ...
def set_process_failed_requests(value: bool) -> None: ...

process_failed_requests = property(get_process_failed_requests, set_process_failed_requests)

Default Value

FALSE

Remarks

This property specifies whether the class's system driver should process failed requests (i.e., fire After* or Notify* events for them).

When this property is enabled, applications can inspect the Status parameter of the aforementioned events to determine whether an operation has failed. If an operation fails, then the corresponding event's Status parameter will contain a nonzero native status code. Applications generally can use the nt_status_to_win_32_error method to convert these status codes into Win32 error codes (but keep in mind that not all native status codes have direct Win32 error code mapping).

serialize_events Property

Whether events should be fired on a single worker thread, or many.

Syntax

def get_serialize_events() -> int: ...
def set_serialize_events(value: int) -> None: ...

serialize_events = property(get_serialize_events, set_serialize_events)

Default Value

0

Remarks

This property specifies whether the class should fire all events serially on a single worker thread, or concurrently on multiple worker threads. The possible values are:

0 (seOnMultipleThreads) The class fires events in the context of multiple worker threads. The MinWorkerThreadCount and MaxWorkerThreadCount configuration settings control how many worker threads are used for this.
1 (seOnOneWorkerThread) The class fires events in the context of one background worker thread.

Please refer to the Threading and Concurrency topic for more information.

Note: This property cannot be changed when active is True, and it cannot be changed within events.

tag Property

This property stores application-defined data specific to a particular instance of the class.

Syntax

def get_tag() -> int: ...
def set_tag(value: int) -> None: ...

tag = property(get_tag, set_tag)

Default Value

0

Remarks

This property can be used to store data specific to a particular instance of the class.

add_filter_rule Method

This method adds a standard filter rule.

Syntax

def add_filter_rule(mask: str, notify_flags: int) -> bool: ...

Remarks

This method adds a standard filter rule for the files and directories that match the specified Mask. Each rule in a ruleset is uniquely identified by its mask; if a rule with the specified mask already exists, the new rule's parameters are merged into it.

If the rule is added successfully, this method returns True; otherwise, it returns False.

Standard filter rules determine which filesystem operations, of those performed on matching files and directories, the class should fire its events for.

The Mask parameter must be a valid file mask according to the File Masks topic. Only the files and directories that match the specified mask will be covered by the rule.

The NotifyFlags parameter specifies which filesystem operations the class should fire Notification Events for. For example, if the FS_NE_READ flag is present, the on_notify_read_file event will fire after a read operation is performed on any file that matches Mask. The value passed for this parameter should be constructed by ORing together zero or more of the following flags:

FS_NE_NONE0Don't fire for any filesystem operations.

Notification Events will not fire for any filesystem operations.

FS_NE_CREATE0x00000001LFire for file creation operations.

The on_notify_create_file event will fire anytime the OS creates a file or directory. In some cases, this event can cause the on_notify_open_file event to fire; refer to the File Create/Open Events topic for more information.

FS_NE_OPEN0x00000002LFire for file open operations.

The on_notify_open_file event will fire anytime the OS opens a file or directory. In some cases, this event can cause the on_notify_create_file event to fire; refer to the File Create/Open Events topic for more information.

FS_NE_READ0x00000004LFire for read operations.

The on_notify_read_file event will fire anytime the OS reads data from a file.

FS_NE_WRITE0x00000008LFire for write operations.

The on_notify_write_file event will fire anytime the OS writes data to a file.

FS_NE_LOCK_CONTROL0x00000010LFire for lock and unlock operations.

The on_notify_lock, on_notify_unlock_all, on_notify_unlock_all_by_key, and on_notify_unlock_single events will fire, as applicable, anytime the OS locks or unlocks a range of bytes in a file.

FS_NE_CLEANUP0x00000020LFire for file handle cleanup operations.

The on_notify_cleanup_file event will fire anytime a process closes a file or directory handle.

FS_NE_CLOSE0x00000040LFire for file close operations.

The on_notify_close_file event will fire anytime the OS closes a file or directory.

FS_NE_CAN_DELETE0x00000080LFire for 'can be deleted' operations.

The on_notify_can_file_be_deleted event will fire anytime the OS checks whether or not a file or directory can be deleted.

FS_NE_DELETE0x00000100LFire for delete operations.

The on_notify_delete_file event will fire anytime the OS deletes a file or directory.

FS_NE_RENAME0x00000200LFire for rename/move operations.

The on_notify_rename_or_move_file event will fire anytime the OS renames or moves a file or directory.

FS_NE_GET_SECURITY0x00000400LFire for get security operations.

The on_notify_get_file_security event will fire anytime the OS queries the security attributes of a file or directory.

FS_NE_ENUMERATE_DIRECTORY0x00000800LFire for directory enumeration operations.

The on_notify_enumerate_directory event will fire anytime the OS retrieves a directory entry during directory enumeration.

FS_NE_QUERY_FILE_INFO0x00001000LFire for QueryFileInformation operations.

The on_notify_query_file_info event will fire anytime the OS retrieves information about a file or directory.

FS_NE_GET_SIZES0x00002000LFire for get size operations.

The on_notify_get_file_sizes event will fire anytime the OS retrieves a file's size information.

FS_NE_SET_SECURITY0x00004000LFire for set security operations.

The on_notify_set_file_security event will fire anytime the OS changes the security attributes of a file or directory.

FS_NE_SET_ATTRIBUTES0x00008000LFire for file attribute update operations.

The on_notify_set_file_attributes event will fire anytime the OS changes the attributes of a file or directory.

FS_NE_SET_SIZES0x00010000LFire for file resize operations.

The on_notify_set_file_size event will fire anytime the OS resizes a file, and the on_notify_set_allocation_size event will fire anytime the OS changes a file's allocation size.

FS_NE_CREATE_HARD_LINK0x00020000LFire for hard link creation operations.

The on_notify_create_hard_link event will fire anytime the OS creates a hard link.

FS_NE_FSCTL0x00040000LFire for FSCTL operations.

The on_notify_fsctl event will fire anytime an IRP_MJ_FILE_SYSTEM_CONTROL operation occurs.

FS_NE_IOCTL0x00080000LFire for IOCTL operations.

The on_notify_ioctl event will fire anytime an IRP_MJ_DEVICE_CONTROL operation occurs.

FS_NE_SET_FILE_INFO0x00100000LFire for SetFileInformation operations.

The on_notify_set_file_info event will fire anytime the OS changes information about a file or directory.

FS_NE_SET_EA0x00200000LFire for Set Extended Attributes operations.

The on_notify_set_ea event will fire anytime the OS sets extended attributes of a file.

FS_NE_QUERY_EA0x00400000LFire for Query Extended Attributes operations.

The on_notify_query_ea event will fire anytime the OS retrieves extended attributes of a file.

FS_NE_GET_REPARSE_POINT0x00800000LFire for Get Reparse Point operations.

The on_notify_get_reparse_point event will fire anytime the OS reads reparse point information of a file or directory.

FS_NE_SET_REPARSE_POINT0x01000000LFire for Set Reparse Point operations.

The on_notify_set_reparse_point event will fire anytime the OS sets or updates reparse point information for a file or directory.

FS_NE_DELETE_REPARSE_POINT0x02000000LFire for Delete Reparse Point operations.

The on_notify_delete_reparse_point event will fire anytime the OS deletes reparse point information from a file or directory.

FS_NE_ALL-1Fire for all filesystem operations.

Notification Events will fire for all filesystem operations that the class tracks.

Note: The methods and properties related to rule management are not intended to be used from multiple threads at once. Applications that wish to use said methods and properties from multiple threads (e.g., during the on_after_filter_attach_to_volume and on_after_filter_detach_from_volume events) are responsible for employing proper thread synchronization techniques to ensure that manipulation and enumeration of the rule lists both occur in a thread-safe manner.

add_filter_rule_ex Method

This method adds a standard filter rule with additional match qualifiers.

Syntax

def add_filter_rule_ex(mask: str, ea_name: str, notify_flags: int, min_size: int, max_size: int, included_attributes: int, excluded_attributes: int) -> bool: ...

Remarks

This method adds a standard filter rule for the files and directories that match the specified Mask (which must be provided) and other qualifiers (which are optional). Each rule in a ruleset is uniquely identified by its mask; if a rule with the specified mask already exists, the new rule's parameters are merged into it.

If the rule is added successfully, this method returns True; otherwise, it returns False.

Standard filter rules determine which filesystem operations, of those performed on matching files and directories, the class should fire its events for.

The Mask parameter must be a valid file mask according to the File Masks topic. Only the files and directories that match the specified mask will be covered by the rule.

The EaName parameter specifies the name of an extended attribute that a file or directory must have to qualify as a match; wildcards are not allowed. Pass an empty string if this parameter should not be used as a match qualifier.

The NotifyFlags parameter specifies which filesystem operations the class should fire Notification Events for. For example, if the FS_NE_READ flag is present, the on_notify_read_file event will fire after a read operation is performed on any file that matches Mask. The value passed for this parameter should be constructed by ORing together zero or more of the following flags:

FS_NE_NONE0Don't fire for any filesystem operations.

Notification Events will not fire for any filesystem operations.

FS_NE_CREATE0x00000001LFire for file creation operations.

The on_notify_create_file event will fire anytime the OS creates a file or directory. In some cases, this event can cause the on_notify_open_file event to fire; refer to the File Create/Open Events topic for more information.

FS_NE_OPEN0x00000002LFire for file open operations.

The on_notify_open_file event will fire anytime the OS opens a file or directory. In some cases, this event can cause the on_notify_create_file event to fire; refer to the File Create/Open Events topic for more information.

FS_NE_READ0x00000004LFire for read operations.

The on_notify_read_file event will fire anytime the OS reads data from a file.

FS_NE_WRITE0x00000008LFire for write operations.

The on_notify_write_file event will fire anytime the OS writes data to a file.

FS_NE_LOCK_CONTROL0x00000010LFire for lock and unlock operations.

The on_notify_lock, on_notify_unlock_all, on_notify_unlock_all_by_key, and on_notify_unlock_single events will fire, as applicable, anytime the OS locks or unlocks a range of bytes in a file.

FS_NE_CLEANUP0x00000020LFire for file handle cleanup operations.

The on_notify_cleanup_file event will fire anytime a process closes a file or directory handle.

FS_NE_CLOSE0x00000040LFire for file close operations.

The on_notify_close_file event will fire anytime the OS closes a file or directory.

FS_NE_CAN_DELETE0x00000080LFire for 'can be deleted' operations.

The on_notify_can_file_be_deleted event will fire anytime the OS checks whether or not a file or directory can be deleted.

FS_NE_DELETE0x00000100LFire for delete operations.

The on_notify_delete_file event will fire anytime the OS deletes a file or directory.

FS_NE_RENAME0x00000200LFire for rename/move operations.

The on_notify_rename_or_move_file event will fire anytime the OS renames or moves a file or directory.

FS_NE_GET_SECURITY0x00000400LFire for get security operations.

The on_notify_get_file_security event will fire anytime the OS queries the security attributes of a file or directory.

FS_NE_ENUMERATE_DIRECTORY0x00000800LFire for directory enumeration operations.

The on_notify_enumerate_directory event will fire anytime the OS retrieves a directory entry during directory enumeration.

FS_NE_QUERY_FILE_INFO0x00001000LFire for QueryFileInformation operations.

The on_notify_query_file_info event will fire anytime the OS retrieves information about a file or directory.

FS_NE_GET_SIZES0x00002000LFire for get size operations.

The on_notify_get_file_sizes event will fire anytime the OS retrieves a file's size information.

FS_NE_SET_SECURITY0x00004000LFire for set security operations.

The on_notify_set_file_security event will fire anytime the OS changes the security attributes of a file or directory.

FS_NE_SET_ATTRIBUTES0x00008000LFire for file attribute update operations.

The on_notify_set_file_attributes event will fire anytime the OS changes the attributes of a file or directory.

FS_NE_SET_SIZES0x00010000LFire for file resize operations.

The on_notify_set_file_size event will fire anytime the OS resizes a file, and the on_notify_set_allocation_size event will fire anytime the OS changes a file's allocation size.

FS_NE_CREATE_HARD_LINK0x00020000LFire for hard link creation operations.

The on_notify_create_hard_link event will fire anytime the OS creates a hard link.

FS_NE_FSCTL0x00040000LFire for FSCTL operations.

The on_notify_fsctl event will fire anytime an IRP_MJ_FILE_SYSTEM_CONTROL operation occurs.

FS_NE_IOCTL0x00080000LFire for IOCTL operations.

The on_notify_ioctl event will fire anytime an IRP_MJ_DEVICE_CONTROL operation occurs.

FS_NE_SET_FILE_INFO0x00100000LFire for SetFileInformation operations.

The on_notify_set_file_info event will fire anytime the OS changes information about a file or directory.

FS_NE_SET_EA0x00200000LFire for Set Extended Attributes operations.

The on_notify_set_ea event will fire anytime the OS sets extended attributes of a file.

FS_NE_QUERY_EA0x00400000LFire for Query Extended Attributes operations.

The on_notify_query_ea event will fire anytime the OS retrieves extended attributes of a file.

FS_NE_GET_REPARSE_POINT0x00800000LFire for Get Reparse Point operations.

The on_notify_get_reparse_point event will fire anytime the OS reads reparse point information of a file or directory.

FS_NE_SET_REPARSE_POINT0x01000000LFire for Set Reparse Point operations.

The on_notify_set_reparse_point event will fire anytime the OS sets or updates reparse point information for a file or directory.

FS_NE_DELETE_REPARSE_POINT0x02000000LFire for Delete Reparse Point operations.

The on_notify_delete_reparse_point event will fire anytime the OS deletes reparse point information from a file or directory.

FS_NE_ALL-1Fire for all filesystem operations.

Notification Events will fire for all filesystem operations that the class tracks.

The MinSize and MaxSize parameters specify the minimum and maximum size, in bytes, that a file can be to qualify as a match. Pass -1 for either parameter if it should not be used as a match qualifier.

The IncludedAttributes and ExcludedAttributes parameters specify which file attributes a file or directory must have or not have to qualify as a match. Pass 0 for either parameter if it should not be used as a match qualifier.

Note: The methods and properties related to rule management are not intended to be used from multiple threads at once. Applications that wish to use said methods and properties from multiple threads (e.g., during the on_after_filter_attach_to_volume and on_after_filter_detach_from_volume events) are responsible for employing proper thread synchronization techniques to ensure that manipulation and enumeration of the rule lists both occur in a thread-safe manner.

add_passthrough_rule Method

This method adds a passthrough rule.

Syntax

def add_passthrough_rule(mask: str, notify_flags: int) -> bool: ...

Remarks

This method adds a passthrough rule for the files and directories that match the specified Mask. Each rule in a ruleset is uniquely identified by its mask; if a rule with the specified mask already exists, the new rule's parameters are merged into it.

If the rule is added successfully, this method returns True; otherwise, it returns False.

Passthrough rules exclude matching files and directories from being processed by other filter rules.

The Mask parameter must be a valid file mask according to the File Masks topic. Only the files and directories that match the specified mask will be covered by the rule.

The NotifyFlags parameter specifies which filesystem operations the class should not fire Notification Events for. The value passed for this parameter should be constructed by ORing together zero or more of the following flags:

FS_NE_NONE0Don't fire for any filesystem operations.

Notification Events will not fire for any filesystem operations.

FS_NE_CREATE0x00000001LFire for file creation operations.

The on_notify_create_file event will fire anytime the OS creates a file or directory. In some cases, this event can cause the on_notify_open_file event to fire; refer to the File Create/Open Events topic for more information.

FS_NE_OPEN0x00000002LFire for file open operations.

The on_notify_open_file event will fire anytime the OS opens a file or directory. In some cases, this event can cause the on_notify_create_file event to fire; refer to the File Create/Open Events topic for more information.

FS_NE_READ0x00000004LFire for read operations.

The on_notify_read_file event will fire anytime the OS reads data from a file.

FS_NE_WRITE0x00000008LFire for write operations.

The on_notify_write_file event will fire anytime the OS writes data to a file.

FS_NE_LOCK_CONTROL0x00000010LFire for lock and unlock operations.

The on_notify_lock, on_notify_unlock_all, on_notify_unlock_all_by_key, and on_notify_unlock_single events will fire, as applicable, anytime the OS locks or unlocks a range of bytes in a file.

FS_NE_CLEANUP0x00000020LFire for file handle cleanup operations.

The on_notify_cleanup_file event will fire anytime a process closes a file or directory handle.

FS_NE_CLOSE0x00000040LFire for file close operations.

The on_notify_close_file event will fire anytime the OS closes a file or directory.

FS_NE_CAN_DELETE0x00000080LFire for 'can be deleted' operations.

The on_notify_can_file_be_deleted event will fire anytime the OS checks whether or not a file or directory can be deleted.

FS_NE_DELETE0x00000100LFire for delete operations.

The on_notify_delete_file event will fire anytime the OS deletes a file or directory.

FS_NE_RENAME0x00000200LFire for rename/move operations.

The on_notify_rename_or_move_file event will fire anytime the OS renames or moves a file or directory.

FS_NE_GET_SECURITY0x00000400LFire for get security operations.

The on_notify_get_file_security event will fire anytime the OS queries the security attributes of a file or directory.

FS_NE_ENUMERATE_DIRECTORY0x00000800LFire for directory enumeration operations.

The on_notify_enumerate_directory event will fire anytime the OS retrieves a directory entry during directory enumeration.

FS_NE_QUERY_FILE_INFO0x00001000LFire for QueryFileInformation operations.

The on_notify_query_file_info event will fire anytime the OS retrieves information about a file or directory.

FS_NE_GET_SIZES0x00002000LFire for get size operations.

The on_notify_get_file_sizes event will fire anytime the OS retrieves a file's size information.

FS_NE_SET_SECURITY0x00004000LFire for set security operations.

The on_notify_set_file_security event will fire anytime the OS changes the security attributes of a file or directory.

FS_NE_SET_ATTRIBUTES0x00008000LFire for file attribute update operations.

The on_notify_set_file_attributes event will fire anytime the OS changes the attributes of a file or directory.

FS_NE_SET_SIZES0x00010000LFire for file resize operations.

The on_notify_set_file_size event will fire anytime the OS resizes a file, and the on_notify_set_allocation_size event will fire anytime the OS changes a file's allocation size.

FS_NE_CREATE_HARD_LINK0x00020000LFire for hard link creation operations.

The on_notify_create_hard_link event will fire anytime the OS creates a hard link.

FS_NE_FSCTL0x00040000LFire for FSCTL operations.

The on_notify_fsctl event will fire anytime an IRP_MJ_FILE_SYSTEM_CONTROL operation occurs.

FS_NE_IOCTL0x00080000LFire for IOCTL operations.

The on_notify_ioctl event will fire anytime an IRP_MJ_DEVICE_CONTROL operation occurs.

FS_NE_SET_FILE_INFO0x00100000LFire for SetFileInformation operations.

The on_notify_set_file_info event will fire anytime the OS changes information about a file or directory.

FS_NE_SET_EA0x00200000LFire for Set Extended Attributes operations.

The on_notify_set_ea event will fire anytime the OS sets extended attributes of a file.

FS_NE_QUERY_EA0x00400000LFire for Query Extended Attributes operations.

The on_notify_query_ea event will fire anytime the OS retrieves extended attributes of a file.

FS_NE_GET_REPARSE_POINT0x00800000LFire for Get Reparse Point operations.

The on_notify_get_reparse_point event will fire anytime the OS reads reparse point information of a file or directory.

FS_NE_SET_REPARSE_POINT0x01000000LFire for Set Reparse Point operations.

The on_notify_set_reparse_point event will fire anytime the OS sets or updates reparse point information for a file or directory.

FS_NE_DELETE_REPARSE_POINT0x02000000LFire for Delete Reparse Point operations.

The on_notify_delete_reparse_point event will fire anytime the OS deletes reparse point information from a file or directory.

FS_NE_ALL-1Fire for all filesystem operations.

Notification Events will fire for all filesystem operations that the class tracks.

Note: The methods and properties related to rule management are not intended to be used from multiple threads at once. Applications that wish to use said methods and properties from multiple threads (e.g., during the on_after_filter_attach_to_volume and on_after_filter_detach_from_volume events) are responsible for employing proper thread synchronization techniques to ensure that manipulation and enumeration of the rule lists both occur in a thread-safe manner.

add_passthrough_rule_ex Method

This method adds a passthrough rule with additional match qualifiers.

Syntax

def add_passthrough_rule_ex(mask: str, ea_name: str, notify_flags: int, min_size: int, max_size: int, included_attributes: int, excluded_attributes: int) -> bool: ...

Remarks

This method adds a passthrough rule for the files and directories that match the specified Mask (which must be provided) and other qualifiers (which are optional). Each rule in a ruleset is uniquely identified by its mask; if a rule with the specified mask already exists, the new rule's parameters are merged into it.

If the rule is added successfully, this method returns True; otherwise, it returns False.

Passthrough rules exclude matching files and directories from being processed by other filter rules.

The Mask parameter must be a valid file mask according to the File Masks topic. Only the files and directories that match the specified mask will be covered by the rule.

The EaName parameter specifies the name of an extended attribute that a file or directory must have to qualify as a match; wildcards are not allowed. Pass an empty string if this parameter should not be used as a match qualifier.

The NotifyFlags parameter specifies which filesystem operations the class should not fire Notification Events for. The value passed for this parameter should be constructed by ORing together zero or more of the following flags:

FS_NE_NONE0Don't fire for any filesystem operations.

Notification Events will not fire for any filesystem operations.

FS_NE_CREATE0x00000001LFire for file creation operations.

The on_notify_create_file event will fire anytime the OS creates a file or directory. In some cases, this event can cause the on_notify_open_file event to fire; refer to the File Create/Open Events topic for more information.

FS_NE_OPEN0x00000002LFire for file open operations.

The on_notify_open_file event will fire anytime the OS opens a file or directory. In some cases, this event can cause the on_notify_create_file event to fire; refer to the File Create/Open Events topic for more information.

FS_NE_READ0x00000004LFire for read operations.

The on_notify_read_file event will fire anytime the OS reads data from a file.

FS_NE_WRITE0x00000008LFire for write operations.

The on_notify_write_file event will fire anytime the OS writes data to a file.

FS_NE_LOCK_CONTROL0x00000010LFire for lock and unlock operations.

The on_notify_lock, on_notify_unlock_all, on_notify_unlock_all_by_key, and on_notify_unlock_single events will fire, as applicable, anytime the OS locks or unlocks a range of bytes in a file.

FS_NE_CLEANUP0x00000020LFire for file handle cleanup operations.

The on_notify_cleanup_file event will fire anytime a process closes a file or directory handle.

FS_NE_CLOSE0x00000040LFire for file close operations.

The on_notify_close_file event will fire anytime the OS closes a file or directory.

FS_NE_CAN_DELETE0x00000080LFire for 'can be deleted' operations.

The on_notify_can_file_be_deleted event will fire anytime the OS checks whether or not a file or directory can be deleted.

FS_NE_DELETE0x00000100LFire for delete operations.

The on_notify_delete_file event will fire anytime the OS deletes a file or directory.

FS_NE_RENAME0x00000200LFire for rename/move operations.

The on_notify_rename_or_move_file event will fire anytime the OS renames or moves a file or directory.

FS_NE_GET_SECURITY0x00000400LFire for get security operations.

The on_notify_get_file_security event will fire anytime the OS queries the security attributes of a file or directory.

FS_NE_ENUMERATE_DIRECTORY0x00000800LFire for directory enumeration operations.

The on_notify_enumerate_directory event will fire anytime the OS retrieves a directory entry during directory enumeration.

FS_NE_QUERY_FILE_INFO0x00001000LFire for QueryFileInformation operations.

The on_notify_query_file_info event will fire anytime the OS retrieves information about a file or directory.

FS_NE_GET_SIZES0x00002000LFire for get size operations.

The on_notify_get_file_sizes event will fire anytime the OS retrieves a file's size information.

FS_NE_SET_SECURITY0x00004000LFire for set security operations.

The on_notify_set_file_security event will fire anytime the OS changes the security attributes of a file or directory.

FS_NE_SET_ATTRIBUTES0x00008000LFire for file attribute update operations.

The on_notify_set_file_attributes event will fire anytime the OS changes the attributes of a file or directory.

FS_NE_SET_SIZES0x00010000LFire for file resize operations.

The on_notify_set_file_size event will fire anytime the OS resizes a file, and the on_notify_set_allocation_size event will fire anytime the OS changes a file's allocation size.

FS_NE_CREATE_HARD_LINK0x00020000LFire for hard link creation operations.

The on_notify_create_hard_link event will fire anytime the OS creates a hard link.

FS_NE_FSCTL0x00040000LFire for FSCTL operations.

The on_notify_fsctl event will fire anytime an IRP_MJ_FILE_SYSTEM_CONTROL operation occurs.

FS_NE_IOCTL0x00080000LFire for IOCTL operations.

The on_notify_ioctl event will fire anytime an IRP_MJ_DEVICE_CONTROL operation occurs.

FS_NE_SET_FILE_INFO0x00100000LFire for SetFileInformation operations.

The on_notify_set_file_info event will fire anytime the OS changes information about a file or directory.

FS_NE_SET_EA0x00200000LFire for Set Extended Attributes operations.

The on_notify_set_ea event will fire anytime the OS sets extended attributes of a file.

FS_NE_QUERY_EA0x00400000LFire for Query Extended Attributes operations.

The on_notify_query_ea event will fire anytime the OS retrieves extended attributes of a file.

FS_NE_GET_REPARSE_POINT0x00800000LFire for Get Reparse Point operations.

The on_notify_get_reparse_point event will fire anytime the OS reads reparse point information of a file or directory.

FS_NE_SET_REPARSE_POINT0x01000000LFire for Set Reparse Point operations.

The on_notify_set_reparse_point event will fire anytime the OS sets or updates reparse point information for a file or directory.

FS_NE_DELETE_REPARSE_POINT0x02000000LFire for Delete Reparse Point operations.

The on_notify_delete_reparse_point event will fire anytime the OS deletes reparse point information from a file or directory.

FS_NE_ALL-1Fire for all filesystem operations.

Notification Events will fire for all filesystem operations that the class tracks.

The MinSize and MaxSize parameters specify the minimum and maximum size, in bytes, that a file can be to qualify as a match. Pass -1 for either parameter if it should not be used as a match qualifier.

The IncludedAttributes and ExcludedAttributes parameters specify which file attributes a file or directory must have or not have to qualify as a match. Pass 0 for either parameter if it should not be used as a match qualifier.

Note: The methods and properties related to rule management are not intended to be used from multiple threads at once. Applications that wish to use said methods and properties from multiple threads (e.g., during the on_after_filter_attach_to_volume and on_after_filter_detach_from_volume events) are responsible for employing proper thread synchronization techniques to ensure that manipulation and enumeration of the rule lists both occur in a thread-safe manner.

config Method

Sets or retrieves a configuration setting.

Syntax

def config(configuration_string: str) -> str: ...

Remarks

config is a generic method available in every class. It is used to set and retrieve configuration settings for the class.

These settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the config method.

To set a configuration setting named PROPERTY, you must call Config("PROPERTY=VALUE"), where VALUE is the value of the setting expressed as a string. For boolean values, use the strings "True", "False", "0", "1", "Yes", or "No" (case does not matter).

To read (query) the value of a configuration setting, you must call Config("PROPERTY"). The value will be returned as a string.

delete_all_filter_rules Method

This method deletes all standard filter rules.

Syntax

def delete_all_filter_rules() -> bool: ...

Remarks

This method deletes all standard filter rules that are currently present.

If the rules are deleted successfully, this method returns True; otherwise, it returns False.

To delete standard filter rules individually, use the delete_filter_rule method instead.

Note: The methods and properties related to rule management are not intended to be used from multiple threads at once. Applications that wish to use said methods and properties from multiple threads (e.g., during the on_after_filter_attach_to_volume and on_after_filter_detach_from_volume events) are responsible for employing proper thread synchronization techniques to ensure that manipulation and enumeration of the rule lists both occur in a thread-safe manner.

delete_all_passthrough_rules Method

This method deletes all passthrough rules.

Syntax

def delete_all_passthrough_rules() -> bool: ...

Remarks

This method deletes all passthrough rules that are currently present.

If the rules are deleted successfully, this method returns True; otherwise, it returns False.

To delete passthrough rules individually, use the delete_passthrough_rule method instead.

Note: The methods and properties related to rule management are not intended to be used from multiple threads at once. Applications that wish to use said methods and properties from multiple threads (e.g., during the on_after_filter_attach_to_volume and on_after_filter_detach_from_volume events) are responsible for employing proper thread synchronization techniques to ensure that manipulation and enumeration of the rule lists both occur in a thread-safe manner.

delete_filter_rule Method

This method deletes a particular standard filter rule.

Syntax

def delete_filter_rule(mask: str, notify_flags: int) -> bool: ...

Remarks

This method deletes the specified NotifyFlags from the standard filter rule identified by Mask. If NotifyFlags includes all flags currently present in the rule, then the entire rule is deleted; otherwise, the flags specified by NotifyFlags are simply removed from the rule. If the flags or this rule are deleted successfully, this method returns True; otherwise, it returns False.

The Mask parameter must be the file mask of an existing rule. If a rule with the specified mask cannot be found, this method will fail.

The NotifyFlags parameter specifies which Notification Event flags should be removed from the rule. The value passed for this parameter should be constructed by ORing together zero or more of the following flags:

FS_NE_NONE0Don't fire for any filesystem operations.

Notification Events will not fire for any filesystem operations.

FS_NE_CREATE0x00000001LFire for file creation operations.

The on_notify_create_file event will fire anytime the OS creates a file or directory. In some cases, this event can cause the on_notify_open_file event to fire; refer to the File Create/Open Events topic for more information.

FS_NE_OPEN0x00000002LFire for file open operations.

The on_notify_open_file event will fire anytime the OS opens a file or directory. In some cases, this event can cause the on_notify_create_file event to fire; refer to the File Create/Open Events topic for more information.

FS_NE_READ0x00000004LFire for read operations.

The on_notify_read_file event will fire anytime the OS reads data from a file.

FS_NE_WRITE0x00000008LFire for write operations.

The on_notify_write_file event will fire anytime the OS writes data to a file.

FS_NE_LOCK_CONTROL0x00000010LFire for lock and unlock operations.

The on_notify_lock, on_notify_unlock_all, on_notify_unlock_all_by_key, and on_notify_unlock_single events will fire, as applicable, anytime the OS locks or unlocks a range of bytes in a file.

FS_NE_CLEANUP0x00000020LFire for file handle cleanup operations.

The on_notify_cleanup_file event will fire anytime a process closes a file or directory handle.

FS_NE_CLOSE0x00000040LFire for file close operations.

The on_notify_close_file event will fire anytime the OS closes a file or directory.

FS_NE_CAN_DELETE0x00000080LFire for 'can be deleted' operations.

The on_notify_can_file_be_deleted event will fire anytime the OS checks whether or not a file or directory can be deleted.

FS_NE_DELETE0x00000100LFire for delete operations.

The on_notify_delete_file event will fire anytime the OS deletes a file or directory.

FS_NE_RENAME0x00000200LFire for rename/move operations.

The on_notify_rename_or_move_file event will fire anytime the OS renames or moves a file or directory.

FS_NE_GET_SECURITY0x00000400LFire for get security operations.

The on_notify_get_file_security event will fire anytime the OS queries the security attributes of a file or directory.

FS_NE_ENUMERATE_DIRECTORY0x00000800LFire for directory enumeration operations.

The on_notify_enumerate_directory event will fire anytime the OS retrieves a directory entry during directory enumeration.

FS_NE_QUERY_FILE_INFO0x00001000LFire for QueryFileInformation operations.

The on_notify_query_file_info event will fire anytime the OS retrieves information about a file or directory.

FS_NE_GET_SIZES0x00002000LFire for get size operations.

The on_notify_get_file_sizes event will fire anytime the OS retrieves a file's size information.

FS_NE_SET_SECURITY0x00004000LFire for set security operations.

The on_notify_set_file_security event will fire anytime the OS changes the security attributes of a file or directory.

FS_NE_SET_ATTRIBUTES0x00008000LFire for file attribute update operations.

The on_notify_set_file_attributes event will fire anytime the OS changes the attributes of a file or directory.

FS_NE_SET_SIZES0x00010000LFire for file resize operations.

The on_notify_set_file_size event will fire anytime the OS resizes a file, and the on_notify_set_allocation_size event will fire anytime the OS changes a file's allocation size.

FS_NE_CREATE_HARD_LINK0x00020000LFire for hard link creation operations.

The on_notify_create_hard_link event will fire anytime the OS creates a hard link.

FS_NE_FSCTL0x00040000LFire for FSCTL operations.

The on_notify_fsctl event will fire anytime an IRP_MJ_FILE_SYSTEM_CONTROL operation occurs.

FS_NE_IOCTL0x00080000LFire for IOCTL operations.

The on_notify_ioctl event will fire anytime an IRP_MJ_DEVICE_CONTROL operation occurs.

FS_NE_SET_FILE_INFO0x00100000LFire for SetFileInformation operations.

The on_notify_set_file_info event will fire anytime the OS changes information about a file or directory.

FS_NE_SET_EA0x00200000LFire for Set Extended Attributes operations.

The on_notify_set_ea event will fire anytime the OS sets extended attributes of a file.

FS_NE_QUERY_EA0x00400000LFire for Query Extended Attributes operations.

The on_notify_query_ea event will fire anytime the OS retrieves extended attributes of a file.

FS_NE_GET_REPARSE_POINT0x00800000LFire for Get Reparse Point operations.

The on_notify_get_reparse_point event will fire anytime the OS reads reparse point information of a file or directory.

FS_NE_SET_REPARSE_POINT0x01000000LFire for Set Reparse Point operations.

The on_notify_set_reparse_point event will fire anytime the OS sets or updates reparse point information for a file or directory.

FS_NE_DELETE_REPARSE_POINT0x02000000LFire for Delete Reparse Point operations.

The on_notify_delete_reparse_point event will fire anytime the OS deletes reparse point information from a file or directory.

FS_NE_ALL-1Fire for all filesystem operations.

Notification Events will fire for all filesystem operations that the class tracks.

To delete all standard filter rules, use the delete_all_filter_rules method instead.

Note: The methods and properties related to rule management are not intended to be used from multiple threads at once. Applications that wish to use said methods and properties from multiple threads (e.g., during the on_after_filter_attach_to_volume and on_after_filter_detach_from_volume events) are responsible for employing proper thread synchronization techniques to ensure that manipulation and enumeration of the rule lists both occur in a thread-safe manner.

delete_passthrough_rule Method

This method deletes a particular passthrough rule.

Syntax

def delete_passthrough_rule(mask: str, notify_flags: int) -> bool: ...

Remarks

This method deletes the specified NotifyFlags from the passthrough rule identified by Mask. If NotifyFlags includes all flags currently present in the rule, then the entire rule is deleted; otherwise, the flags specified by NotifyFlags are simply removed from the rule. If the flags or this rule are deleted successfully, this method returns True; otherwise, it returns False.

The Mask parameter must be the file mask of an existing rule. If a rule with the specified mask cannot be found, this method will fail.

The NotifyFlags parameter specifies which Notification Event flags should be removed from the rule. The value passed for this parameter should be constructed by ORing together zero or more of the following flags:

FS_NE_NONE0Don't fire for any filesystem operations.

Notification Events will not fire for any filesystem operations.

FS_NE_CREATE0x00000001LFire for file creation operations.

The on_notify_create_file event will fire anytime the OS creates a file or directory. In some cases, this event can cause the on_notify_open_file event to fire; refer to the File Create/Open Events topic for more information.

FS_NE_OPEN0x00000002LFire for file open operations.

The on_notify_open_file event will fire anytime the OS opens a file or directory. In some cases, this event can cause the on_notify_create_file event to fire; refer to the File Create/Open Events topic for more information.

FS_NE_READ0x00000004LFire for read operations.

The on_notify_read_file event will fire anytime the OS reads data from a file.

FS_NE_WRITE0x00000008LFire for write operations.

The on_notify_write_file event will fire anytime the OS writes data to a file.

FS_NE_LOCK_CONTROL0x00000010LFire for lock and unlock operations.

The on_notify_lock, on_notify_unlock_all, on_notify_unlock_all_by_key, and on_notify_unlock_single events will fire, as applicable, anytime the OS locks or unlocks a range of bytes in a file.

FS_NE_CLEANUP0x00000020LFire for file handle cleanup operations.

The on_notify_cleanup_file event will fire anytime a process closes a file or directory handle.

FS_NE_CLOSE0x00000040LFire for file close operations.

The on_notify_close_file event will fire anytime the OS closes a file or directory.

FS_NE_CAN_DELETE0x00000080LFire for 'can be deleted' operations.

The on_notify_can_file_be_deleted event will fire anytime the OS checks whether or not a file or directory can be deleted.

FS_NE_DELETE0x00000100LFire for delete operations.

The on_notify_delete_file event will fire anytime the OS deletes a file or directory.

FS_NE_RENAME0x00000200LFire for rename/move operations.

The on_notify_rename_or_move_file event will fire anytime the OS renames or moves a file or directory.

FS_NE_GET_SECURITY0x00000400LFire for get security operations.

The on_notify_get_file_security event will fire anytime the OS queries the security attributes of a file or directory.

FS_NE_ENUMERATE_DIRECTORY0x00000800LFire for directory enumeration operations.

The on_notify_enumerate_directory event will fire anytime the OS retrieves a directory entry during directory enumeration.

FS_NE_QUERY_FILE_INFO0x00001000LFire for QueryFileInformation operations.

The on_notify_query_file_info event will fire anytime the OS retrieves information about a file or directory.

FS_NE_GET_SIZES0x00002000LFire for get size operations.

The on_notify_get_file_sizes event will fire anytime the OS retrieves a file's size information.

FS_NE_SET_SECURITY0x00004000LFire for set security operations.

The on_notify_set_file_security event will fire anytime the OS changes the security attributes of a file or directory.

FS_NE_SET_ATTRIBUTES0x00008000LFire for file attribute update operations.

The on_notify_set_file_attributes event will fire anytime the OS changes the attributes of a file or directory.

FS_NE_SET_SIZES0x00010000LFire for file resize operations.

The on_notify_set_file_size event will fire anytime the OS resizes a file, and the on_notify_set_allocation_size event will fire anytime the OS changes a file's allocation size.

FS_NE_CREATE_HARD_LINK0x00020000LFire for hard link creation operations.

The on_notify_create_hard_link event will fire anytime the OS creates a hard link.

FS_NE_FSCTL0x00040000LFire for FSCTL operations.

The on_notify_fsctl event will fire anytime an IRP_MJ_FILE_SYSTEM_CONTROL operation occurs.

FS_NE_IOCTL0x00080000LFire for IOCTL operations.

The on_notify_ioctl event will fire anytime an IRP_MJ_DEVICE_CONTROL operation occurs.

FS_NE_SET_FILE_INFO0x00100000LFire for SetFileInformation operations.

The on_notify_set_file_info event will fire anytime the OS changes information about a file or directory.

FS_NE_SET_EA0x00200000LFire for Set Extended Attributes operations.

The on_notify_set_ea event will fire anytime the OS sets extended attributes of a file.

FS_NE_QUERY_EA0x00400000LFire for Query Extended Attributes operations.

The on_notify_query_ea event will fire anytime the OS retrieves extended attributes of a file.

FS_NE_GET_REPARSE_POINT0x00800000LFire for Get Reparse Point operations.

The on_notify_get_reparse_point event will fire anytime the OS reads reparse point information of a file or directory.

FS_NE_SET_REPARSE_POINT0x01000000LFire for Set Reparse Point operations.

The on_notify_set_reparse_point event will fire anytime the OS sets or updates reparse point information for a file or directory.

FS_NE_DELETE_REPARSE_POINT0x02000000LFire for Delete Reparse Point operations.

The on_notify_delete_reparse_point event will fire anytime the OS deletes reparse point information from a file or directory.

FS_NE_ALL-1Fire for all filesystem operations.

Notification Events will fire for all filesystem operations that the class tracks.

To delete all passthrough rules, use the delete_all_passthrough_rules method instead.

Note: The methods and properties related to rule management are not intended to be used from multiple threads at once. Applications that wish to use said methods and properties from multiple threads (e.g., during the on_after_filter_attach_to_volume and on_after_filter_detach_from_volume events) are responsible for employing proper thread synchronization techniques to ensure that manipulation and enumeration of the rule lists both occur in a thread-safe manner.

file_matches_mask Method

This method checks whether a particular file or directory name matches the specified mask.

Syntax

def file_matches_mask(mask: str, file_name: str, case_sensitive: bool) -> bool: ...

Remarks

This method checks whether the file or directory name specified by FileName matches Mask; if it does, this method returns True. The CaseSensitive parameter controls whether a case-sensitive match should be performed.

Note: This method does not handle so-called DOS_* wildcards (DOS_STAR, DOS_QM, DOS_DOT). The explanation about the characters can be found in the MSDN article. If you have a mask that includes one of those characters on Windows, you can use the RtlIsNameInExpression function of Windows API.

Note: As the explanation states, "When you do a case-insensitive search and do not provide a translation table, the name is converted to uppercase."

get_dos_path_name Method

This method retrieves the DOS path name of the file or directory by its native (NT) path.

Syntax

def get_dos_path_name(nt_path: str) -> str: ...

Remarks

This method retrieves the DOS path name of the file or directory by its native path, specified in the NTPath parameter.

Note: Such name conversion is not always possible (e.g., the volume can have none or more than one DOS names). In this case, an empty string is returned.

Note: This method can be called only within events, and it must be called in the same thread that the event was originally fired on.

get_driver_status Method

This method retrieves the status of the class's system driver.

Syntax

def get_driver_status(product_guid: str) -> int: ...

Remarks

This method retrieves the status of the class's system driver. This status can then be used to verify whether it has been properly installed and is ready for use.

The value returned by the method corresponds to the dwCurrentState field of the SERVICE_STATUS structure from the Windows API. It will be one of the following:

MODULE_STATUS_NOT_PRESENT0x00000000The specified module is not present on the system.

MODULE_STATUS_STOPPED0x00000001The specified module is in the Stopped state.

MODULE_STATUS_RUNNING0x00000004The specified module is loaded and running.

ProductGUID is used to distinguish among driver installations performed by different applications. Such information is necessary to guard against unexpected situations, such as the driver being uninstalled by one application despite other applications still needing it.

Therefore, to ensure proper operation, it is critical that each individual application have its own unique ProductGUID value, and that applications (and their installation scripts) use that value when calling any of the following methods:

This method is available in both the class API and the Installer DLL included with the product; please refer to the Driver Installation topic for more information about the latter.

Note: This method cannot be called within events.

get_driver_version Method

This method retrieves the version of the class's system driver.

Syntax

def get_driver_version(product_guid: str) -> int: ...

Remarks

This method retrieves the version of the class's system driver. The value is returned as a 64-bit integer composed of four 16-bit words that each correspond to a piece of the overall module version. For example, a version of 2.32.6.28 would cause the value 0x000200200006001C to be returned.

If the class's system driver is not installed, this method returns 0.

ProductGUID is used to distinguish among driver installations performed by different applications. Such information is necessary to guard against unexpected situations, such as the driver being uninstalled by one application despite other applications still needing it.

Therefore, to ensure proper operation, it is critical that each individual application have its own unique ProductGUID value, and that applications (and their installation scripts) use that value when calling any of the following methods:

This method is available in both the class API and the Installer DLL included with the product; please refer to the Driver Installation topic for more information about the latter.

Note: This method cannot be called within events.

get_event_filename Method

This method retrieves the name of the file or directory, to which the event applies.

Syntax

def get_event_filename() -> str: ...

Remarks

This method can be called within event handlers of events, related to the file or directory operations, to retrieve the name of the file or directory, to which the operation applies. If the query fails or an event does not have an associated filename, this method returns an empty string.

get_nt_path_name Method

This method retrieves the NT (native) path name of the file or directory by its DOS path.

Syntax

def get_nt_path_name(dos_path: str) -> str: ...

Remarks

This method retrieves the NT (native) path name of the file or directory by its path, specified in the DOSPath parameter.

get_operation_time Method

This method returns the time at which the request was received by the filter driver.

Syntax

def get_operation_time() -> datetime.datetime: ...

Remarks

This method can be called within operation-related events to retrieve the time at which the filter driver received the request. The time is recorded before an event is fired but only when the RecordOperationTime configuration setting is enabled.

The timestamps returned by this method are specified in UTC.

get_originator_process_id Method

Retrieves the Id of the process (PID) that initiated the operation.

Syntax

def get_originator_process_id() -> int: ...

Remarks

This method can be called within events fired for filesystem operations to retrieve the Id of the process (PID) that initiated the operation. If the query fails, this method returns 0.

Please note that PIDs are not unique, and may be reused by different processes over time (though in practice, this is uncommon).

Applications cannot use this method to retrieve information about remote processes accessing drives shared on the network. Windows does not provide such information due to the nature of remote access.

Note: This method can be called only within events, and it must be called in the same thread that the event was originally fired on. However, it must not be called within events that work with opened files since such events can be initiated by system components (e.g., the cache manager, memory manager, etc.). If applications need the information this method returns during such events, they may do the following:

  1. Call this method within the on_create_file or on_open_file event.
  2. Store the information somewhere, and store a reference to it in the event's HandleContext parameter.
  3. In a later event, access the information via the reference stored in HandleContext.
Please refer to the Contexts topic for more information on how to use events' context parameters.

Note: Renaming and deletion of files is performed after the file is opened. Thus, access checks should be performed during file opening as described above.

Note: This method cannot be used from on_cleanup_context event handlers.

get_originator_process_name Method

Retrieves the name of the process that initiated the operation.

Syntax

def get_originator_process_name() -> str: ...

Remarks

This method can be called within events fired for filesystem operations to retrieve the name of the process that initiated the operation. If the query fails, this method returns empty string.

Applications cannot use this method to retrieve information about remote processes accessing drives shared on the network. Windows does not provide such information due to the nature of remote access.

Note: This method can be called only within events, and it must be called in the same thread that the event was originally fired on. However, it must not be called within events that work with opened files since such events can be initiated by system components (e.g., the cache manager, memory manager, etc.). If applications need the information this method returns during such events, they may do the following:

  1. Call this method within the on_create_file or on_open_file event.
  2. Store the information somewhere, and store a reference to it in the event's HandleContext parameter.
  3. In a later event, access the information via the reference stored in HandleContext.
Please refer to the Contexts topic for more information on how to use events' context parameters.

Note: Renaming and deletion of files is performed after the file is opened. Thus, access checks should be performed during file opening as described above.

Note: This method cannot be used from on_cleanup_context event handlers.

get_originator_thread_id Method

Retrieves the Id of the thread that initiated the operation.

Syntax

def get_originator_thread_id() -> int: ...

Remarks

This method can be called within events fired for filesystem operations to retrieve the Id of the thread that initiated the operation. If the query fails, this method returns 0.

Please note that thread Ids are not unique, and may be reused by different threads over time.

Note: This method can be called only within events, and it must be called in the same thread that the event was originally fired on. However, it must not be called within events that work with opened files since such events can be initiated by system components (e.g., the cache manager, memory manager, etc.). If applications need the information this method returns during such events, they may do the following:

  1. Call this method within the on_create_file or on_open_file event.
  2. Store the information somewhere, and store a reference to it in the event's HandleContext parameter.
  3. In a later event, access the information via the reference stored in HandleContext.
Please refer to the Contexts topic for more information on how to use events' context parameters.

Note: Renaming and deletion of files is performed after the file is opened. Thus, access checks should be performed during file opening as described above.

Note: This method cannot be used from on_cleanup_context event handlers.

get_remote_access_information Method

This method returns networking-related information about the operation.

Syntax

def get_remote_access_information(share_name: List[str], client_socket_address_buffer: int, client_socket_address_buffer_size: List[int]) -> None: ...

Remarks

Call this method from *CreateFile/*OpenFile events to retrieve the collected networking details information related to the filesystem operation performed across the network.

Note: The information will be available only when the CollectRemoteOpenInformation configuration setting is enabled.

This method returns the contents of one of two structures, SRV_OPEN_ECP_CONTEXT or NFS_OPEN_ECP_CONTEXT. These structures contain various networking information that differs depending on the remote access type. Please refer to MSDN for additional information.

Depending on the type of remote access, the information is extracted from one of those structures. When the method returns, ShareName will contain the value of either ShareName or ExportAlias field of the corresponding structure. ClientSocketAddressBuffer will contain the value of the SocketAddress or ClientSocketAddress field of the corresponding structure. This field is a structure of the SOCKADDR_STORAGE_NFS type.

When calling the method, an application needs to prepare the buffer of the required size and specify this size of the ClientSocketAddressBuffer buffer in the ClientSocketAddressBufferSize argument.

get_volume_guid Method

This method retrieves the volume GUID of the device targeted by a filesystem operation.

Syntax

def get_volume_guid() -> str: ...

Remarks

This method can be called within events fired for filesystem operations to retrieve the volume GUID of the device targeted by the operation, returned in the Volume{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx} format. If the query fails, this method returns an empty string.

Volume GUIDs can be used to enumerate the mounting points of a device using the Windows API's GetVolumePathNamesForVolumeName function.

Note: This method can be called only within events.

initialize Method

This method initializes the class.

Syntax

def initialize(product_guid: str) -> None: ...

Remarks

This method initializes the class and must be called each time the application starts before attempting to call any of the class's other methods with the exception of installation-related methods.

ProductGUID is used to distinguish among driver installations performed by different applications. Such information is necessary to guard against unexpected situations, such as the driver being uninstalled by one application despite other applications still needing it.

Therefore, to ensure proper operation, it is critical that each individual application have its own unique ProductGUID value, and that applications (and their installation scripts) use that value when calling any of the following methods:

If the required driver was not installed using the install method with the same value of ProductGUID, initialize will return a ERROR_FILE_NOT_FOUND error (Win32 error code 2).

If the loaded kernel-mode driver is older than the user-mode API, initialize will return a ERROR_INVALID_KERNEL_INFO_VERSION error (Win32 error code 340). In this situation, an update of the driver using the install method is required before the class can be used.

install Method

This method installs (or upgrades) the class's system driver.

Syntax

def install(cab_file_name: str, product_guid: str, path_to_install: str, altitude: str, flags: int) -> bool: ...

Remarks

This method is used to install or upgrade the class's system driver. If the system must be rebooted to complete the installation process, this method returns True; otherwise, it returns False.

Important: To upgrade the class's driver, use only the install method. Previously installed versions of the driver should not be uninstalled first. Calling the install method will upgrade the previously installed version.

Please refer to the Driver Installation topic for more information.

CabFileName must be the path of the cbfilter.cab file containing the class's system driver.

Note: This .cab file must remain on the target system (or be available in some other way) after installation, as it is required to uninstall the driver from the system.

ProductGUID is used to distinguish among driver installations performed by different applications. Such information is necessary to guard against unexpected situations, such as the driver being uninstalled by one application despite other applications still needing it.

Therefore, to ensure proper operation, it is critical that each individual application have its own unique ProductGUID value, and that applications (and their installation scripts) use that value when calling any of the following methods:

PathToInstall controls where the driver is installed. Pass empty string (highly recommended) to automatically install them to the appropriate Windows system directory.

Altitude specifies the driver altitude to use . During development, you can use any acceptable altitude value. For deployment, an altitude value must be assigned by Microsoft before deploying a filesystem minifilter in production. After installation, the altitude can be changed at any time using the altitude property. Please refer to the Driver Altitudes topic for more information.

Flags specifies various installation options. It should contain zero or more of the following flags, ORed together:

INSTALL_REMOVE_OLD_VERSIONS0x00000001Uninstall drivers from previous class versions (e.g., 2017).

INSTALL_KEEP_START_TYPE0x00000002Keep the driver's current start type setting in the registry.

If this flag is not set (default), the installation logic will reset the driver's start type setting in the Windows registry to the default value. Setting this flag causes the installation logic to preserve the current value, which may be necessary if the user (or the application) set it previously.

INSTALL_REQUESTS_VIA_DRIVER_STACK0x00000004Whether internal requests to the filesystem are sent directly to the filesystem driver or through the stack of filesystem filter drivers.

This flag is applicable only for CBFilter and CBMonitor.

After installation, the effects of this flag can be changed using the SendRequestsViaDriverStack configuration setting.

INSTALL_ALWAYS_PREPARE_FILES0x00010000Whether the driver should keep track of information for files that are already open when (i.e., were opened before) the class is initialized.

This flag is applicable only for CBFilter and CBMonitor.

If this flag is set, the driver will prepare information about each file as it is opened, regardless of whether a CBFilter/CBMonitor-based application is actually running at the time. This information then allows applications to receive events for any files that are already open when the CBFilter/CBMonitor class is initialized.

Note: These preparations will slow down all file open operations; do not enable this feature unless it is actually necessary.

After installation, the effects of this flag can be changed using the AlwaysPrepareFiles configuration setting.

INSTALL_FORCE_APP_PERMISSION_CHECK0x00020000Whether the driver should require the controller process to have elevated or system privileges.

This flag is not applicable for CBProcess.

If this flag is set, the driver will verify that the controller process is a system service (or is executing with elevated privileges) anytime a file is opened. If the controller process does not meet these requirements, the file will be skipped (i.e., not filtered in any way).

Note: This additional verification will slow down all file open operations.

After installation, the effects of this flag can be changed using the ForceAppPermissionCheck configuration setting.

INSTALL_FORCE_SECURITY_CHECKS0x00040000Whether the driver should prevent the controller process from filtering files that it would not normally have access to.

This flag is not applicable for CBProcess.

If this flag is set, the driver will check the security permissions of the controller process anytime a file is opened to verify that the process has access to the file. If the controller process does not have access to the file, the file will be skipped (i.e., not filtered in any way). For example, if this flag is set and the controller process is running with limited privileges, then the driver will not allow it to filter files that require greater privileges to access.

Note: This additional verification will slow down all file open operations.

After installation, the effects of this flag can be changed using the ForceSecurityChecks configuration setting.

Note: Enabling the AlwaysPrepareFiles and/or SendRequestsViaDriverStack configuration settings before calling this method will cause the corresponding flags to be added automatically. These configuration settings can also be used to toggle the corresponding options at any time after installation.

This method is available in both the class API and the Installer DLL included with the product; please refer to the Driver Installation topic for more information about the latter.

This method requires administrative rights to execute successfully. If the user account of the process that calls this method doesn't have such rights, the call will fail with an ERROR_PRIVILEGE_NOT_HELD (0x0522) error.

Note: This method cannot be called within events.

nt_status_to_win_32_error Method

This method converts a native status code to a Win32 error code.

Syntax

def nt_status_to_win_32_error(status: int) -> int: ...

Remarks

This method converts the native status code specified by Status to a Win32 error code. If the specified native status code does not map directly to a Win32 error code, this method returns ERROR_MR_MID_NOT_FOUND (317).

shutdown_system Method

Shuts down or reboots the operating system.

Syntax

def shutdown_system(shutdown_prompt: str, timeout: int, force_close_apps: bool, reboot: bool) -> bool: ...

Remarks

This method shuts down or (if Reboot is True) reboots the operating system. If the appropriate privileges cannot be obtained, or if the InitiateSystemShutdown system call returns False, then this method will return False; otherwise, it returns True. This method can be used if the installation or uninstallation function requires the system to be rebooted in order to complete.

ShutdownPrompt, if non-empty, specifies a message that the OS should display to the user for Timeout seconds. If empty string is passed for ShutdownPrompt, no message is displayed and the Timeout parameter's value is ignored.

ForceCloseApps specifies whether the OS should forcefully close all applications. Please keep in mind that forceful closing of applications with unsaved data can lead to data loss.

Reboot specifies whether the OS should reboot (True) or just shut down (False).

This method is available in both the class API and the Installer DLL included with the product; please refer to the Driver Installation topic for more information about the latter.

Note: This method cannot be called within events.

start_filter Method

This method starts filtering filesystem operations.

Syntax

def start_filter() -> None: ...

Remarks

This method attaches the filter, causing the class's system driver to start filtering filesystem operations according to the filter rules currently present. Rules can be added and removed both before and after this method is called, as long as the initialize method is called before doing anything else.

This method can fail for a number of reasons, including (but not limited to) the following:

  • If the class's system driver has not been properly installed, or is awaiting a system reboot (as indicated by the return value of install), this method fails with an ERROR_FILE_NOT_FOUND (2) error code.
  • If the initialize method has not been called yet, this method fails with an ERROR_NOT_READY (21) error code.
  • If the filter is already active, this method fails with an ERROR_CONNECTION_ACTIVE (1230) error code.

stop_filter Method

This method stops filtering filesystem operations.

Syntax

def stop_filter(reserved: bool) -> None: ...

Remarks

This method detaches the filter, causing the class's system driver to stop filtering filesystem operations. This method will block until all pending requests have been completed and the filter has been detached.

The Reserved parameter is obsolete.

uninstall Method

This method uninstalls the class's system driver.

Syntax

def uninstall(cab_file_name: str, product_guid: str, installed_path: str, flags: int) -> bool: ...

Remarks

This method is used to uninstall the class's system driver. If the system must be rebooted to complete the uninstallation process, this method returns True; otherwise, it returns False.

Important: To upgrade the class's driver, use only the install method. Previously installed versions of the driver should not be uninstalled first. Calling the install method will upgrade the previously installed version.

Please refer to the Driver Installation topic for more information.

The same values must be passed for the CabFileName, ProductGUID, and InstalledPath parameters as were passed when install was called; please refer to its documentation for more information.

Flags specifies which versions of the class's system driver should be uninstalled and which should be set by ORing together one or more of the following values:

UNINSTALL_VERSION_PREVIOUS0x00000001Uninstall modules from previous product versions.

UNINSTALL_VERSION_CURRENT0x00000002Uninstall modules from the current product version.

UNINSTALL_VERSION_ALL0x00000003Uninstall modules from all product versions.

This method is available in both the class API and the Installer DLL included with the product; please refer to the Driver Installation topic for more information about the latter.

This method requires administrative rights to execute successfully. If the user account of the process that calls this method doesn't have such rights, the call will fail with an ERROR_PRIVILEGE_NOT_HELD (0x0522) error.

Note: This method cannot be called within events.

on_after_filter_attach_to_volume Event

This event fires after the filter attaches to a newly mounted filesystem volume.

Syntax

class CBMonitorAfterFilterAttachToVolumeEventParams(object):
  @property
  def volume_name() -> str: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_after_filter_attach_to_volume() -> Callable[[CBMonitorAfterFilterAttachToVolumeEventParams], None]: ...
@on_after_filter_attach_to_volume.setter
def on_after_filter_attach_to_volume(event_hook: Callable[[CBMonitorAfterFilterAttachToVolumeEventParams], None]) -> None: ...

Remarks

This event fires after the filter attaches to the newly mounted filesystem volume specified by VolumeName. Please refer to the fire_volume_events property for more information.

Applications need to handle this event only if the fire_volume_events property includes the FS_MOUNT_CONTROL flag.

Note: This event won't fire for any volumes skipped during the on_before_filter_attach_to_volume event; please refer to its documentation for more information.

Applications can use this event to add volume-specific rules for the volume that has been mounted (keeping in mind that this event does not fire for volumes that are already present when start_filter is called). Applications that intend to do so must ensure that proper thread synchronization techniques are used when manipulating or enumerating the rule lists, because this event's handler will always execute in the context of some worker thread.

Applications must be aware that this event fires as a direct response to a filesystem state change (mount or unmount). Various system components or third-party actors can perform supplementary filesystem mounting and unmounting during main unmount operations (e.g., Volume Service is one such component). This can cause seemingly excessive events to be fired, and sometimes they can be fired out of order (such as two *Attach or *Detach events fired in a row).

The format of the VolumeName parameter's value depends on whether the ResolveNtDeviceToDriveLetter configuration setting is enabled; please refer to its documentation for more information. Applications can obtain additional information about a volume by retrieving its GUID using the get_volume_guid method, and then using that GUID to call various Windows API functions.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason (e.g., a resource is not available or security checks failed), set it to a nonzero value to report an appropriate error. Please see the Error Reporting and Handling topic for more information.

This event is fired synchronously; please refer to the Event Types topic for more information.

on_after_filter_detach_from_volume Event

This event fires after the filter detaches from a filesystem volume.

Syntax

class CBMonitorAfterFilterDetachFromVolumeEventParams(object):
  @property
  def volume_name() -> str: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_after_filter_detach_from_volume() -> Callable[[CBMonitorAfterFilterDetachFromVolumeEventParams], None]: ...
@on_after_filter_detach_from_volume.setter
def on_after_filter_detach_from_volume(event_hook: Callable[[CBMonitorAfterFilterDetachFromVolumeEventParams], None]) -> None: ...

Remarks

This event fires after the filter detaches from the filesystem volume specified by VolumeName, typically because of the volume being unmounted. Please refer to the fire_volume_events property for more information.

Applications need to handle this event only if the fire_volume_events property includes the FS_MOUNT_CONTROL flag.

Note: This event won't fire for any volumes skipped during the on_before_filter_attach_to_volume event; please refer to its documentation for more information.

Applications should use this event to remove volume-specific rules for the volume that has been unmounted. Applications that intend to do so must ensure that proper thread synchronization techniques are used when manipulating or enumerating the rule lists, because this event's handler will always execute in the context of some worker thread.

Applications must be aware that this event fires as a direct response to a filesystem state change (mount or unmount). Various system components or third-party actors can perform supplementary filesystem mounting and unmounting during main unmount operations (e.g., Volume Service is one such component). This can cause seemingly excessive events to be fired, and sometimes they can be fired out of order (such as two *Attach or *Detach events fired in a row).

The format of the VolumeName parameter's value depends on whether the ResolveNtDeviceToDriveLetter configuration setting is enabled; please refer to its documentation for more information. Applications can obtain additional information about a volume by retrieving its GUID using the get_volume_guid method, and then using that GUID to call various Windows API functions.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason (e.g., a resource is not available or security checks failed), set it to a nonzero value to report an appropriate error. Please see the Error Reporting and Handling topic for more information.

This event is fired synchronously; please refer to the Event Types topic for more information.

on_before_filter_attach_to_volume Event

This event fires before the filter attaches to a newly mounted filesystem volume.

Syntax

class CBMonitorBeforeFilterAttachToVolumeEventParams(object):
  @property
  def volume_name() -> str: ...

  @property
  def skip_volume() -> bool: ...
  @skip_volume.setter
  def skip_volume(value) -> None: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_before_filter_attach_to_volume() -> Callable[[CBMonitorBeforeFilterAttachToVolumeEventParams], None]: ...
@on_before_filter_attach_to_volume.setter
def on_before_filter_attach_to_volume(event_hook: Callable[[CBMonitorBeforeFilterAttachToVolumeEventParams], None]) -> None: ...

Remarks

This event fires before the filter attaches to the newly mounted filesystem volume specified by VolumeName. Please refer to the fire_volume_events property for more information.

Applications need to handle this event only if the fire_volume_events property includes the FS_MOUNT_CONTROL flag.

The VolumeName parameter's value is always an NT native format in this event (unlike the other volume-related events, listed below, where its format depends on the ResolveNtDeviceToDriveLetter configuration setting). It is therefore recommended that applications add volume-specific rules, if desired, during the on_after_filter_attach_to_volume event rather than this one. Applications can obtain additional information about a volume by retrieving its GUID using the get_volume_guid method, and then using that GUID to call various Windows API functions.

The SkipVolume parameter specifies whether the class's system driver should skip the specified volume (i.e., not attach the filter to it). Setting this parameter to True will cause all filesystem operations that target to volume to be completely ignored by the class's system driver. It also will prevent any of the following events from firing for the volume:

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason (e.g., a resource is not available or security checks failed), set it to a nonzero value to report an appropriate error. Please see the Error Reporting and Handling topic for more information.

This event is fired synchronously; please refer to the Event Types topic for more information.

Applications must be aware that this event fires as a direct response to a filesystem state change (mount or unmount). Various system components or third-party actors can perform supplementary filesystem mounting and unmounting during main unmount operations (e.g., Volume Service is one such component). This can cause seemingly excessive events to be fired, and sometimes they can be fired out of order (such as two *Attach or *Detach events fired in a row).

on_error Event

This event fires if an unhandled error occurs during an event.

Syntax

class CBMonitorErrorEventParams(object):
  @property
  def error_code() -> int: ...

  @property
  def description() -> str: ...

# In class CBMonitor:
@property
def on_error() -> Callable[[CBMonitorErrorEventParams], None]: ...
@on_error.setter
def on_error(event_hook: Callable[[CBMonitorErrorEventParams], None]) -> None: ...

Remarks

This event fires if an unhandled error occurs during another event. Developers can use this information to track down unhandled errors in an application's event handlers.

Note: Not everything is possible or allowed in the event handlers. For details, see the Recursive Calls topic.

on_filter_start Event

This event fires once the filter has attached and filtering has started.

Syntax

class CBMonitorFilterStartEventParams(object):
  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_filter_start() -> Callable[[CBMonitorFilterStartEventParams], None]: ...
@on_filter_start.setter
def on_filter_start(event_hook: Callable[[CBMonitorFilterStartEventParams], None]) -> None: ...

Remarks

This event fires once the filter has attached and filtering has started; please refer to the start_filter method for more information.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason (e.g., a resource is not available or security checks failed), set it to a nonzero value to report an appropriate error. Please see the Error Reporting and Handling topic for more information.

This event is fired synchronously; please refer to the Event Types topic for more information.

on_filter_stop Event

This event fires once filtering has stopped and the filter has detached.

Syntax

class CBMonitorFilterStopEventParams(object):
  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_filter_stop() -> Callable[[CBMonitorFilterStopEventParams], None]: ...
@on_filter_stop.setter
def on_filter_stop(event_hook: Callable[[CBMonitorFilterStopEventParams], None]) -> None: ...

Remarks

This event fires once filtering has stopped and the filter has detached.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired synchronously; please refer to the Event Types topic for more information.

on_notify_can_file_be_deleted Event

This event fires when the OS marks a file or directory for deletion or removes such a mark.

Syntax

class CBMonitorNotifyCanFileBeDeletedEventParams(object):
  @property
  def file_name() -> str: ...

  @property
  def request_type() -> int: ...

  @property
  def can_delete() -> bool: ...

  @property
  def status() -> int: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_can_file_be_deleted() -> Callable[[CBMonitorNotifyCanFileBeDeletedEventParams], None]: ...
@on_notify_can_file_be_deleted.setter
def on_notify_can_file_be_deleted(event_hook: Callable[[CBMonitorNotifyCanFileBeDeletedEventParams], None]) -> None: ...

Remarks

This event fires when the OS marks the file or directory specified by FileName for deletion or removes such a mark.

Files and directories can be deleted in two ways: (1) a file or directory can be opened with the FILE_FLAG_DELETE_ON_CLOSE flag, or (2) some process may call Windows API's NtSetInformationFile function with FILE_DISPOSITION_INFORMATION or FILE_DISPOSITION_INFORMATION_EX structure as a parameter.

If the file or directory is created or opened with the FILE_FLAG_DELETE_ON_CLOSE flag, this event is fired shortly after the on_notify_create_file or on_notify_open_file event.

Applications need to handle this event only if they have added a standard filter rule that includes [the TBD]. FS_NE_CAN_DELETE flag.

The RequestType indicates which kind of system request resulted in firing this event. It can be one of the following:

DEL_REQ_OPEN_FLAG0x1The file or directory is opened with the FILE_FLAG_DELETE_ON_CLOSE flag

DEL_REQ_SET_DISPOSITION0x2The system has sent the IRP_MJ_SET_INFORMATION request with SetFileDisposition structure as a parameter.

This request usually is sent using the NtSetInformationFile() Windows native API function.

The CanDelete parameter reflects whether or not the file or directory can be deleted.

The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the nt_status_to_win_32_error method.

Note: This event will not fire for failed requests unless the process_failed_requests property is enabled.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

on_notify_cleanup_file Event

This event fires when a file or directory handle has been closed.

Syntax

class CBMonitorNotifyCleanupFileEventParams(object):
  @property
  def file_name() -> str: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_cleanup_file() -> Callable[[CBMonitorNotifyCleanupFileEventParams], None]: ...
@on_notify_cleanup_file.setter
def on_notify_cleanup_file(event_hook: Callable[[CBMonitorNotifyCleanupFileEventParams], None]) -> None: ...

Remarks

This event fires when a handle to the file or directory specified by FileName has been closed. This event differs from on_notify_close_file in that on_notify_cleanup_file fires when an open handle to the specified file or directory is closed by a process, whereas on_notify_close_file may be fired much later when the OS itself decides that the file or directory can be formally closed.

Other events may fire for the file or directory in the time between when this event fires and when the on_notify_close_file event fires. For example, system components, such as the memory manager or cache manager, may cause the on_notify_read_file and on_notify_write_file events to fire.

Applications need to handle this event only if they have added a standard filter rule that includes [the TBD]. FS_NE_CLEANUP flag.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

on_notify_close_file Event

This event fires when a file or directory has been closed.

Syntax

class CBMonitorNotifyCloseFileEventParams(object):
  @property
  def file_name() -> str: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_close_file() -> Callable[[CBMonitorNotifyCloseFileEventParams], None]: ...
@on_notify_close_file.setter
def on_notify_close_file(event_hook: Callable[[CBMonitorNotifyCloseFileEventParams], None]) -> None: ...

Remarks

This event fires when the file or directory specified by FileName has been closed.

Applications need to handle this event only if they have added a standard filter rule that includes [the TBD]. FS_NE_CLOSE flag.

If the file or directory was marked for deletion earlier, the on_notify_delete_file will fire shortly before this event.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

on_notify_create_file Event

This event fires when a file or directory has been created.

Syntax

class CBMonitorNotifyCreateFileEventParams(object):
  @property
  def file_name() -> str: ...

  @property
  def existing_attributes() -> int: ...

  @property
  def desired_access() -> int: ...

  @property
  def attributes() -> int: ...

  @property
  def share_mode() -> int: ...

  @property
  def options() -> int: ...

  @property
  def create_disposition() -> int: ...

  @property
  def security_descriptor() -> c_void_p: ...

  @property
  def length() -> int: ...

  @property
  def status() -> int: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_create_file() -> Callable[[CBMonitorNotifyCreateFileEventParams], None]: ...
@on_notify_create_file.setter
def on_notify_create_file(event_hook: Callable[[CBMonitorNotifyCreateFileEventParams], None]) -> None: ...

Remarks

This event fires when the file or directory specified by FileName has been created. Please refer to the File Create/Open Events topic for more information about how the class determines whether to fire this event or on_notify_open_file.

Applications need to handle this event only if they have added a standard filter rule that includes [the TBD]. FS_NE_CREATE flag.

Note: Applications must have the FilterOwnRequests configuration setting enabled if they wish to filter their own file/directory creation requests.

When extended rules are used or the AlwaysRequestAttributesOnOpen configuration setting is enabled, the driver requests attributes of the entity from the filesystem and passes them to ExistingAttributes. If the attributes are not requested, this parameter contains 0.

The DesiredAccess, Attributes, ShareMode, and CreateDisposition parameters reflect the values that were passed for the similarly named parameters of the Windows API's CreateFile function (or, more accurately, the values carried by the IRP_MJ_CREATE IRP).

DesiredAccess may contain one or more of the following access flags:

DESIRED_ACCESS_FILE_LIST_DIRECTORY0x00000001For a directory, the right to list the contents of the directory.

DESIRED_ACCESS_FILE_READ_DATA0x00000001For a file object, the right to read the corresponding file data.

For a directory object, the right to read the corresponding directory data.

DESIRED_ACCESS_FILE_ADD_FILE0x00000002For a directory, the right to create a file in the directory.

DESIRED_ACCESS_FILE_WRITE_DATA0x00000002For a file object, the right to write data to the file.

For a directory object, the right to create a file in the directory

DESIRED_ACCESS_FILE_ADD_SUBDIRECTORY0x00000004For a directory, the right to create a subdirectory.

DESIRED_ACCESS_FILE_APPEND_DATA0x00000004For a file object, the right to append data to the file.

(For local files, write operations will not overwrite existing data if this flag is specified without FILE_WRITE_DATA.) For a directory object, the right to create a subdirectory (FILE_ADD_SUBDIRECTORY).

DESIRED_ACCESS_FILE_READ_EA0x00000008The right to read extended file attributes.

DESIRED_ACCESS_FILE_WRITE_EA0x00000010The right to write extended file attributes.

DESIRED_ACCESS_FILE_EXECUTE0x00000020For a native code file, the right to execute the file.

This access right given to scripts may cause the script to be executable, depending on the script interpreter.

DESIRED_ACCESS_FILE_DELETE_CHILD0x00000040For a directory, the right to delete a directory and all the files it contains, including read-only files.

DESIRED_ACCESS_FILE_READ_ATTRIBUTES0x00000080The right to read file attributes.

DESIRED_ACCESS_FILE_WRITE_ATTRIBUTES0x00000100The right to write file attributes.

DESIRED_ACCESS_READ_CONTROL0x00020000The right to read the information in the file or directory object's security descriptor.

This does not include the information in the SACL.

DESIRED_ACCESS_STANDARD_RIGHTS_READ0x00020000Includes READ_CONTROL, which is the right to read the information in the file or directory object's security descriptor.

This does not include the information in the SACL.

DESIRED_ACCESS_STANDARD_RIGHTS_WRITE0x00020000Same as STANDARD_RIGHTS_READ

DESIRED_ACCESS_STANDARD_RIGHTS_EXECUTE0x00020000Same as STANDARD_RIGHTS_READ

DESIRED_ACCESS_SYNCHRONIZE0x00100000The right to use the object for synchronization.

This enables a thread to wait until the object is in the signaled state. Some object types do not support this access right.

DESIRED_ACCESS_FILE_ALL_ACCESS0x001F01FFAll possible access rights for a file.

DESIRED_ACCESS_FILE_GENERIC_READ0x00120089A combinarion of flags that allow reading of the file.

Note: Don't match received values against this flag. Instead, use flags that specify the rights that you want to verify or add/remove.

DESIRED_ACCESS_FILE_GENERIC_WRITE0x00120116A combinarion of flags that allow modifications to the file.

Note: Don't match received values against this flag. Instead, use flags that specify the rights that you want to verify or add/remove.

DESIRED_ACCESS_FILE_GENERIC_EXECUTE0x001200A0A combinarion of flags that allow execution of the file.

Note: Don't match received values against this flag. Instead, use flags that specify the rights that you want to verify or add/remove.

Attributes may contain one or more of the following attributes:

FILE_SYS_ATTR_READ_ONLY0x00000001The file is read-only.

Applications can read the file, but cannot write to it or delete it. This attribute is not honored on directories.

FILE_SYS_ATTR_HIDDEN0x00000002The file or directory is hidden.

The file is not included in an ordinary directory listing.

FILE_SYS_ATTR_SYSTEM0x00000004A file or directory that the operating system uses a part of, or uses exclusively.

FILE_SYS_ATTR_DIRECTORY0x00000010The entry is a directory.

FILE_SYS_ATTR_ARCHIVE0x00000020The entry is an archive file or directory.

Applications typically use this attribute to mark files for backup or removal.

FILE_SYS_ATTR_NORMAL0x00000080A file doesn't have other attributes set.

This attribute is valid only when used alone.

FILE_SYS_ATTR_TEMPORARY0x00000100A file that is being used for temporary storage.

File systems avoid writing data back to mass storage if sufficient cache memory is available, because typically, an application deletes a temporary file after the handle is closed. In that scenario, the system can entirely avoid writing the data. Otherwise, the data are written after the handle is closed.

FILE_SYS_ATTR_SPARSE_FILE0x00000200A file that is a sparse file.

FILE_SYS_ATTR_REPARSE_POINT0x00000400A file that is a reparse point or a symbolic link.

FILE_SYS_ATTR_COMPRESSED0x00000800A file or directory that is compressed.

For a file, all of the data in the file are compressed. For a directory, compression is the default for newly created files and subdirectories. A filesystem implementation can make use of this attribute by setting the support_compressed_attribute property to True and then properly handling the on_get_file_info, on_enumerate_directory, and on_set_file_attributes events.

FILE_SYS_ATTR_OFFLINE0x00001000The data of a file are not available immediately.

This attribute indicates that the file data are physically moved to offline storage.

FILE_SYS_ATTR_NOT_CONTENT_INDEXED0x00002000The file or directory is not to be indexed by the content indexing service.

FILE_SYS_ATTR_ENCRYPTED0x00004000A file or directory that is encrypted.

For a file, all data streams in the file are encrypted. For a directory, encryption is the default for newly created files and subdirectories.

Note: This flag is used by NTFS and the OS sends undocumented requests to the filesystem based on this flag. The flag should not be used for files in custom filesystem implementations.

FILE_SYS_ATTR_VIRTUAL0x00010000Reserved.

Note: This flag is reserved by the OS and should not be used for files in custom filesystem implementations.

FILE_SYS_ATTR_RECALL_ON_OPEN0x00040000The file or directory has no physical representation on the local system; the item is virtual.

Opening the item will be more expensive than normal (e.g., it will cause at least some of it to be fetched from a remote store). This flag is reported by filesystems during directory enumerations.

ShareMode may contain zero or more of the following share mode flags:

FILESYS_SHARE_READ0x00000001Enables subsequent open operations on a file or device to request read access.

Enables subsequent open operations to request read access; otherwise, no process can open the file or device if it requests read access. If this flag is not specified, but the file or device has been opened for read access, the function fails.

FILESYS_SHARE_WRITE0x00000002Enables subsequent open operations on a file or device to request write access.

Enables subsequent open operations to request write access; otherwise, no process can open the file or device if it requests write access. If this flag is not specified, but the file or device has been opened for write access or has a file mapping with write access, the function fails.

FILESYS_SHARE_DELETE0x00000004Enables subsequent open operations on a file or device to request delete access.

Enables subsequent open operations to request delete access; otherwise, no process can open the file or device if it requests delete access. If this flag is not specified, but the file or device has been opened for delete access, the function fails.

Note: Delete access allows both delete and rename operations.

CreateDisposition may contain one of the following values:

FILE_DISPOSITION_CREATE_NEW0x00000001Creates a new file, only if it does not already exist.

If the specified file exists, the operation fails with an "already exists" error.

FILE_DISPOSITION_CREATE_ALWAYS0x00000002Creates a new file, always.

If the specified file exists and is writable, the system overwrites the file. If the specified file does not exist and is a valid path, a new file is created.

FILE_DISPOSITION_OPEN_EXISTING0x00000003Opens a file, only if it exists

If the specified file does not exist, opening fails.

FILE_DISPOSITION_OPEN_ALWAYS0x00000004Opens a file, always.

If the specified file exists, the operation succeeds. If the specified file does not exist and is a valid path to a writable location, the a file is created.

FILE_DISPOSITION_TRUNCATE_EXISTING0x00000005Opens a file and truncates it so that its size is zero bytes, only if it exists.

If the specified file does not exist, the operation fails with a "file not found" error.

Options contains the flags that are described in the CreateOptions parameter of the native API's ZwCreateFile function. Most of those flags correspond to flags passed in the FlagsAndAttributes parameter of the Windows API's CreateFile function, but some flags are specific to the native API. If you need those flags, check both functions' descriptions.

Please refer to Microsoft's documentation for detailed information about these constants.

To determine whether the request was for a file or a directory, compare Attributes against the FILE_SYS_ATTR_DIRECTORY constant, as follows: // Check whether the request is for a file or a directory. bool isDirectory = Attributes & FILE_SYS_ATTR_DIRECTORY == FILE_SYS_ATTR_DIRECTORY; FILE_SYS_ATTR_DIRECTORY will be present if it was specified by the calling process or if the existing filesystem entry is a directory.

To determine whether a file will be deleted when its last handle is closed, compare Options against the Windows API's FILE_FLAG_DELETE_ON_CLOSE constant, as follows: // Check whether the file will be deleted on close. bool deleteOnClose = Options & FILE_FLAG_DELETE_ON_CLOSE == FILE_FLAG_DELETE_ON_CLOSE; Note: Because files can be deleted in different ways, do not use this check to take actions related to tracking file deletion operations. Instead, use the events related to file deletion.

When a file or directory is created using the CreateFile() Windows API function, a caller can specify the security descriptor with the security information. This security information should be applied to a newly created file or directory. The class passes this security information in the SecurityInformation and SecurityDescriptor parameters, when the PassSecurityInFileOpenEvents configuration setting is enabled. If this configuration setting is omitted, the corresponding parameters are empty.

The SecurityInformation parameter reflects which pieces of security information, of those present in SecurityDescriptor, are valid and should have been applied. Please refer to Microsoft's SECURITY_INFORMATION data type documentation for more information about possible values.

The SecurityDescriptor parameter points to a memory buffer that contains the security information. The Length parameter reflects the length of this data, in bytes. Please see the Buffer Parameters topic for more information on how to work with memory buffer event parameters.

The data are formatted as a SECURITY_DESCRIPTOR structure in self-relative format; please refer to the Microsoft's documentation for more information.

If the Options contains the FILE_FLAG_DELETE_ON_CLOSE flag, the on_notify_can_file_be_deleted event will fire after this event.

If the file is created with extended attributes passed in the request, the on_notify_set_ea event will fire after this event.

The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the nt_status_to_win_32_error method.

Note: This event will not fire for failed requests unless the process_failed_requests property is enabled.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

on_notify_create_hard_link Event

This event fires when a hard link has been created.

Syntax

class CBMonitorNotifyCreateHardLinkEventParams(object):
  @property
  def file_name() -> str: ...

  @property
  def link_name() -> str: ...

  @property
  def status() -> int: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_create_hard_link() -> Callable[[CBMonitorNotifyCreateHardLinkEventParams], None]: ...
@on_notify_create_hard_link.setter
def on_notify_create_hard_link(event_hook: Callable[[CBMonitorNotifyCreateHardLinkEventParams], None]) -> None: ...

Remarks

This event fires when a hard link to the file specified by FileName has been created. Please refer to Microsoft's Hard Links article for more information about hard links.

Applications need to handle this event only if they have added a standard filter rule that includes [the TBD]. FS_NE_CREATE_HARD_LINK flag.

The LinkName parameter reflects the name of the created hard link.

The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the nt_status_to_win_32_error method.

Note: This event will not fire for failed requests unless the process_failed_requests property is enabled.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

on_notify_delete_file Event

This event fires when a file or directory has been deleted.

Syntax

class CBMonitorNotifyDeleteFileEventParams(object):
  @property
  def file_name() -> str: ...

  @property
  def request_type() -> int: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_delete_file() -> Callable[[CBMonitorNotifyDeleteFileEventParams], None]: ...
@on_notify_delete_file.setter
def on_notify_delete_file(event_hook: Callable[[CBMonitorNotifyDeleteFileEventParams], None]) -> None: ...

Remarks

This event fires when the file or directory specified by FileName has been deleted. More specifically, this event is queued for delivery after the final IRP_MJ_CLOSE I/O request packet (IRP) has been processed by the filesystem (i.e., after the last handle to the file or directory is closed and the file or directory is gone) and before on_notify_close_file is queued.

Applications need to handle this event only if they have added a standard filter rule that includes [the TBD]. FS_NE_DELETE flag.

The RequestType indicates which kind of system request resulted in firing this event. It can be one of the following:

DEL_REQ_OPEN_FLAG0x1The file or directory is opened with the FILE_FLAG_DELETE_ON_CLOSE flag

DEL_REQ_SET_DISPOSITION0x2The system has sent the IRP_MJ_SET_INFORMATION request with SetFileDisposition structure as a parameter.

This request usually is sent using the NtSetInformationFile() Windows native API function.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

on_notify_delete_reparse_point Event

This event fires when a file or directory's reparse point has been deleted.

Syntax

class CBMonitorNotifyDeleteReparsePointEventParams(object):
  @property
  def file_name() -> str: ...

  @property
  def status() -> int: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_delete_reparse_point() -> Callable[[CBMonitorNotifyDeleteReparsePointEventParams], None]: ...
@on_notify_delete_reparse_point.setter
def on_notify_delete_reparse_point(event_hook: Callable[[CBMonitorNotifyDeleteReparsePointEventParams], None]) -> None: ...

Remarks

This event fires when a reparse point has been deleted from the file or directory specified by FileName.

Note: The file or directory was not deleted, only a reparse point was.

Applications need to handle this event only if they have added a standard filter rule that includes [the TBD]. FS_NE_DELETE_REPARSE_POINT flag.

The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the nt_status_to_win_32_error method.

Note: This event will not fire for failed requests unless the process_failed_requests property is enabled.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

on_notify_enumerate_directory Event

This event fires when a directory entry has been returned during directory enumeration.

Syntax

class CBMonitorNotifyEnumerateDirectoryEventParams(object):
  @property
  def directory_name() -> str: ...

  @property
  def flags() -> int: ...

  @property
  def index() -> int: ...

  @property
  def file_name() -> str: ...

  @property
  def creation_time() -> datetime.datetime: ...

  @property
  def last_access_time() -> datetime.datetime: ...

  @property
  def last_write_time() -> datetime.datetime: ...

  @property
  def change_time() -> datetime.datetime: ...

  @property
  def size() -> int: ...

  @property
  def allocation_size() -> int: ...

  @property
  def file_id() -> int: ...

  @property
  def attributes() -> int: ...

  @property
  def status() -> int: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_enumerate_directory() -> Callable[[CBMonitorNotifyEnumerateDirectoryEventParams], None]: ...
@on_notify_enumerate_directory.setter
def on_notify_enumerate_directory(event_hook: Callable[[CBMonitorNotifyEnumerateDirectoryEventParams], None]) -> None: ...

Remarks

This event fires when a directory entry (i.e., file or subdirectory) has been returned during enumeration of the directory specified by DirectoryName.

Applications need to handle this event only if they have added a standard filter rule that includes [the TBD]. FS_NE_ENUMERATE_DIRECTORY flag.

The Flags parameter specifies supplementary information about enumeration. It is a combination of zero or more values:

FS_ENUM_RESTART_SCAN1The requestor specified that directory enumeration must be restarted.

FS_ENUM_RETURN_SINGLE_ENTRY2One entry should be returned.

FS_ENUM_INDEX_SPECIFIED4The requestor specified the index to start enumeration from.

If the Flags parameter contains FS_ENUM_INDEX_SPECIFIED, the Index parameter contains the index as provided by the OS.

The FileName parameter reflects the name of the directory entry.

The CreationTime, LastAccessTime, LastWriteTime, and ChangeTime parameters reflect the entry's time values, specified in UTC.

The Size parameter reflects the size of the file, in bytes; it is always 0 for subdirectories.

The AllocationSize parameter reflects the amount of space allocated for the file, in bytes; it is always 0 for subdirectories.

The FileId parameter reflects the unique Id of the entry, as reported by the filesystem. This Id is used by the network redirector, and some third-party applications, to open files and directories by Id instead of by name. The root directory always uses the predefined Id 0x7FFFFFFFFFFFFFFF.

The Attributes parameter reflects the entry's attributes; please refer to Microsoft's File Attribute Constants article for attribute descriptions.

The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the nt_status_to_win_32_error method.

Note: This event will not fire for failed requests unless the process_failed_requests property is enabled.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

on_notify_filter_attach_to_volume Event

This event fires when the filter has been attached to a newly mounted filesystem volume.

Syntax

class CBMonitorNotifyFilterAttachToVolumeEventParams(object):
  @property
  def volume_name() -> str: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_filter_attach_to_volume() -> Callable[[CBMonitorNotifyFilterAttachToVolumeEventParams], None]: ...
@on_notify_filter_attach_to_volume.setter
def on_notify_filter_attach_to_volume(event_hook: Callable[[CBMonitorNotifyFilterAttachToVolumeEventParams], None]) -> None: ...

Remarks

This event fires when the filter has been attached to the newly mounted filesystem volume specified by VolumeName. Please refer to the fire_volume_events property for more information.

Applications need to handle this event only if the fire_volume_events property includes the FS_MOUNT_NOTIFY flag.

Note: This event won't fire for any volumes skipped during the on_before_filter_attach_to_volume event; please refer to its documentation for more information.

Applications that use volume-specific rules should typically add such rules during the on_after_filter_attach_to_volume event, which is fired synchronously, rather than this one.

The format of the VolumeName parameter's value depends on whether the ResolveNtDeviceToDriveLetter configuration setting is enabled; please refer to its documentation for more information. Applications can obtain additional information about a volume by retrieving its GUID using the get_volume_guid method, and then using that GUID to call various Windows API functions.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

Applications must be aware that this event fires as a direct response to a filesystem state change (mount or unmount). Various system components or third-party actors can perform supplementary filesystem mounting and unmounting during main unmount operations (e.g., Volume Service is one such component). This can cause seemingly excessive events to be fired, and sometimes they can be fired out of order (such as two *Attach or *Detach events fired in a row).

on_notify_filter_detach_from_volume Event

This event fires when the filter has been detached from a filesystem volume.

Syntax

class CBMonitorNotifyFilterDetachFromVolumeEventParams(object):
  @property
  def volume_name() -> str: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_filter_detach_from_volume() -> Callable[[CBMonitorNotifyFilterDetachFromVolumeEventParams], None]: ...
@on_notify_filter_detach_from_volume.setter
def on_notify_filter_detach_from_volume(event_hook: Callable[[CBMonitorNotifyFilterDetachFromVolumeEventParams], None]) -> None: ...

Remarks

This event fires when the filter has been detached from the filesystem volume specified by VolumeName, typically as a result of the volume being unmounted. Please refer to the fire_volume_events property for more information.

Applications need to handle this event only if the fire_volume_events property includes the FS_MOUNT_NOTIFY flag.

Note: This event won't fire for any volumes skipped during the on_before_filter_attach_to_volume event; please refer to its documentation for more information.

Applications that use volume-specific rules typically should remove such rules during the on_after_filter_detach_from_volume event, which is fired synchronously, rather than this one.

The format of the VolumeName parameter's value depends on whether the ResolveNtDeviceToDriveLetter configuration setting is enabled; please refer to its documentation for more information. Applications can obtain additional information about a volume by retrieving its GUID using the get_volume_guid method, and then using that GUID to call various Windows API functions.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

Applications must be aware that this event fires as a direct response to a filesystem state change (mount or unmount). Various system components or third-party actors can perform supplementary filesystem mounting and unmounting during main unmount operations (e.g., Volume Service is one such component). This can cause seemingly excessive events to be fired, and sometimes they can be fired out of order (such as two *Attach or *Detach events fired in a row).

on_notify_fsctl Event

This event fires when an IRP_MJ_FILE_SYSTEM_CONTROL operation has occurred.

Syntax

class CBMonitorNotifyFsctlEventParams(object):
  @property
  def file_name() -> str: ...

  @property
  def fs_control_code() -> int: ...

  @property
  def in_buffer() -> c_void_p: ...

  @property
  def in_buffer_length() -> int: ...

  @property
  def in_buffer_valid_bytes() -> int: ...

  @property
  def out_buffer() -> c_void_p: ...

  @property
  def out_buffer_length() -> int: ...

  @property
  def out_buffer_valid_bytes() -> int: ...

  @property
  def status() -> int: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_fsctl() -> Callable[[CBMonitorNotifyFsctlEventParams], None]: ...
@on_notify_fsctl.setter
def on_notify_fsctl(event_hook: Callable[[CBMonitorNotifyFsctlEventParams], None]) -> None: ...

Remarks

This event fires when an IRP_MJ_FILE_SYSTEM_CONTROL (FSCTL) operation has occurred. Such requests are sent using the Windows API's DeviceIoControl function (user mode), or ZwFsControlFile function (kernel mode); please refer to Microsoft's documentation for more information.

Applications need to handle this event only if they have added a standard filter rule that includes [the TBD]. FS_NE_FSCTL flag.

The FileName parameter reflects the file, directory, or volume targeted by the request.

The FsControlCode parameter reflects the requested filesystem control code (FSCTL).

The InBuffer parameter points to a memory buffer that contains the data required to perform the operation. The InBufferLength and InBufferValidBytes parameters reflect the capacity of InBuffer and the length of the data it contains (respectively), in bytes; InBufferValidBytes may be less than InBufferLength (unless the request did not include data, in which case both will be 0).

The OutBuffer parameter points to a memory buffer that contains the data returned by the operation. The OutBufferLength and OutBufferValidBytes parameters reflect the capacity of OutBuffer and the length of the data it contains (respectively), in bytes; OutBufferValidBytes may be less than OutBufferLength (unless the operation did not return data, in which case both will be 0).

Please see the Buffer Parameters topic for more information on how to work with memory buffer event parameters.

The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the nt_status_to_win_32_error method.

Note: This event will not fire for failed requests unless the process_failed_requests property is enabled.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

on_notify_get_file_security Event

This event fires when a file or directory's security attributes have been retrieved.

Syntax

class CBMonitorNotifyGetFileSecurityEventParams(object):
  @property
  def file_name() -> str: ...

  @property
  def security_information() -> int: ...

  @property
  def security_descriptor() -> c_void_p: ...

  @property
  def length() -> int: ...

  @property
  def status() -> int: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_get_file_security() -> Callable[[CBMonitorNotifyGetFileSecurityEventParams], None]: ...
@on_notify_get_file_security.setter
def on_notify_get_file_security(event_hook: Callable[[CBMonitorNotifyGetFileSecurityEventParams], None]) -> None: ...

Remarks

This event fires when security attributes have been retrieved for the file or directory specified by FileName.

Note: This event will not fire every time a file or directory is accessed. To check file security upon each access to a file or directory, implement the file create and open events and perform the necessary checks there instead.

Applications need to handle this event only if they have added a standard filter rule that includes [the TBD]. FS_NE_GET_SECURITY flag.

The SecurityInformation parameter indicates which pieces of security information were requested. Please refer to Microsoft's SECURITY_INFORMATION data-type documentation for more information about possible values.

The SecurityDescriptor parameter points to a memory buffer that, if the request was successful, contains the requested security information. The Length parameter reflects the length of this data, in bytes. Please see the Buffer Parameters topic for more information on how to work with memory buffer event parameters.

The data are formatted as a SECURITY_DESCRIPTOR structure in self-relative format; please refer to the Microsoft's documentation for more information.

The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the nt_status_to_win_32_error method.

Note: This event will not fire for failed requests unless the process_failed_requests property is enabled.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

on_notify_get_file_sizes Event

This event fires when a file's size information has been retrieved.

Syntax

class CBMonitorNotifyGetFileSizesEventParams(object):
  @property
  def file_name() -> str: ...

  @property
  def size() -> int: ...

  @property
  def allocation_size() -> int: ...

  @property
  def status() -> int: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_get_file_sizes() -> Callable[[CBMonitorNotifyGetFileSizesEventParams], None]: ...
@on_notify_get_file_sizes.setter
def on_notify_get_file_sizes(event_hook: Callable[[CBMonitorNotifyGetFileSizesEventParams], None]) -> None: ...

Remarks

This event fires when size information has been retrieved for the file specified by FileName.

Applications need to handle this event only if they have added a standard filter rule that includes [the TBD]. FS_NE_GET_SIZES flag.

The Size parameter reflects the actual size of the file, in bytes.

The AllocationSize parameter reflects the amount of space allocated for the file, in bytes.

The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the nt_status_to_win_32_error method.

Note: This event will not fire for failed requests unless the process_failed_requests property is enabled.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

on_notify_get_reparse_point Event

This event fires when a file or directory's reparse point information has been retrieved.

Syntax

class CBMonitorNotifyGetReparsePointEventParams(object):
  @property
  def file_name() -> str: ...

  @property
  def status() -> int: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_get_reparse_point() -> Callable[[CBMonitorNotifyGetReparsePointEventParams], None]: ...
@on_notify_get_reparse_point.setter
def on_notify_get_reparse_point(event_hook: Callable[[CBMonitorNotifyGetReparsePointEventParams], None]) -> None: ...

Remarks

This event fires when reparse point information has been retrieved for the file or directory specified by FileName.

Applications need to handle this event only if they have added a standard filter rule that includes [the TBD]. FS_NE_GET_REPARSE_POINT flag.

The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the nt_status_to_win_32_error method.

Note: This event will not fire for failed requests unless the process_failed_requests property is enabled.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

on_notify_ioctl Event

This event fires when an IRP_MJ_DEVICE_CONTROL operation has occurred.

Syntax

class CBMonitorNotifyIoctlEventParams(object):
  @property
  def file_name() -> str: ...

  @property
  def io_control_code() -> int: ...

  @property
  def in_buffer() -> c_void_p: ...

  @property
  def in_buffer_length() -> int: ...

  @property
  def in_buffer_valid_bytes() -> int: ...

  @property
  def out_buffer() -> c_void_p: ...

  @property
  def out_buffer_length() -> int: ...

  @property
  def out_buffer_valid_bytes() -> int: ...

  @property
  def status() -> int: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_ioctl() -> Callable[[CBMonitorNotifyIoctlEventParams], None]: ...
@on_notify_ioctl.setter
def on_notify_ioctl(event_hook: Callable[[CBMonitorNotifyIoctlEventParams], None]) -> None: ...

Remarks

This event fires when an IRP_MJ_DEVICE_CONTROL (IOCTL) operation has occurred. Such requests are sent using the Windows API's DeviceIoControl function (user mode), or ZwDeviceIoControlFile function (kernel mode). Please refer to Microsoft's documentation for more information.

Applications need to handle this event only if they have added a standard filter rule that includes [the TBD]. FS_NE_IOCTL flag.

The FileName parameter reflects the file, directory, or volume targeted by the request.

The IoControlCode parameter reflects the requested I/O control code (IOCTL).

The InBuffer parameter points to a memory buffer that contains the data required to perform the operation. The InBufferLength and InBufferValidBytes parameters reflect the capacity of InBuffer and the length of the data it contains (respectively), in bytes; InBufferValidBytes may be less than InBufferLength (unless the request did not include data, in which case both will be 0).

The OutBuffer parameter points to a memory buffer that contains the data returned by the operation. The OutBufferLength and OutBufferValidBytes parameters reflect the capacity of OutBuffer and the length of the data it contains (respectively), in bytes; OutBufferValidBytes may be less than OutBufferLength (unless the operation did not return data, in which case both will be 0).

Please see the Buffer Parameters topic for more information on how to work with memory buffer event parameters.

The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the nt_status_to_win_32_error method.

Note: This event will not fire for failed requests unless the process_failed_requests property is enabled.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

on_notify_lock Event

This event fires when a range of bytes in a file has been locked.

Syntax

class CBMonitorNotifyLockEventParams(object):
  @property
  def file_name() -> str: ...

  @property
  def offset() -> int: ...

  @property
  def length() -> int: ...

  @property
  def key() -> int: ...

  @property
  def fail_immediately() -> bool: ...

  @property
  def exclusive_lock() -> bool: ...

  @property
  def status() -> int: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_lock() -> Callable[[CBMonitorNotifyLockEventParams], None]: ...
@on_notify_lock.setter
def on_notify_lock(event_hook: Callable[[CBMonitorNotifyLockEventParams], None]) -> None: ...

Remarks

This event fires when a range of bytes in the file specified by FileName has been locked; This request is made either by the OS, or on behalf of a user mode application that called the Windows API's LockFile or LockFileEx function.

Applications need to handle this event only if they have added a standard filter rule that includes [the TBD]. FS_NE_LOCK_CONTROL flag.

The Offset parameter reflects the byte offset where the byte range lock starts.

The Length parameter reflects the length of the byte range lock.

The Key parameter reflects the key that the byte range lock is associated with. This key is used to identify the byte range lock in later unlock-by-key requests.

The FailImmediately parameter indicates whether the request was to fail if the lock could not be granted immediately.

The ExclusiveLock parameter indicates whether the byte range lock was to be exclusive (True) or shared (False).

The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the nt_status_to_win_32_error method.

Note: This event will not fire for failed requests unless the process_failed_requests property is enabled.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

on_notify_open_file Event

This event fires when a file or directory has been opened.

Syntax

class CBMonitorNotifyOpenFileEventParams(object):
  @property
  def file_name() -> str: ...

  @property
  def existing_attributes() -> int: ...

  @property
  def desired_access() -> int: ...

  @property
  def attributes() -> int: ...

  @property
  def share_mode() -> int: ...

  @property
  def options() -> int: ...

  @property
  def create_disposition() -> int: ...

  @property
  def security_descriptor() -> c_void_p: ...

  @property
  def length() -> int: ...

  @property
  def status() -> int: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_open_file() -> Callable[[CBMonitorNotifyOpenFileEventParams], None]: ...
@on_notify_open_file.setter
def on_notify_open_file(event_hook: Callable[[CBMonitorNotifyOpenFileEventParams], None]) -> None: ...

Remarks

This event fires when the file or directory specified by FileName has been opened. Please refer to the File Create/Open Events topic for more information about how the class determines whether to fire this event or on_notify_create_file.

Applications need to handle this event only if they have added a standard filter rule that includes [the TBD]. FS_NE_OPEN flag.

Note: Applications must have the FilterOwnRequests configuration setting enabled if they wish to filter their own file/directory open requests.

When extended rules are used or the AlwaysRequestAttributesOnOpen configuration setting is enabled, the driver requests attributes of the entity from the filesystem and passes them to ExistingAttributes. If the attributes are not requested, this parameter contains 0.

The DesiredAccess, Attributes, ShareMode, and CreateDisposition parameters reflect the values that were passed for the similarly named parameters of the Windows API's CreateFile function (or, more accurately, the values carried by the IRP_MJ_CREATE IRP).

DesiredAccess may contain one or more of the following access flags:

DESIRED_ACCESS_FILE_LIST_DIRECTORY0x00000001For a directory, the right to list the contents of the directory.

DESIRED_ACCESS_FILE_READ_DATA0x00000001For a file object, the right to read the corresponding file data.

For a directory object, the right to read the corresponding directory data.

DESIRED_ACCESS_FILE_ADD_FILE0x00000002For a directory, the right to create a file in the directory.

DESIRED_ACCESS_FILE_WRITE_DATA0x00000002For a file object, the right to write data to the file.

For a directory object, the right to create a file in the directory

DESIRED_ACCESS_FILE_ADD_SUBDIRECTORY0x00000004For a directory, the right to create a subdirectory.

DESIRED_ACCESS_FILE_APPEND_DATA0x00000004For a file object, the right to append data to the file.

(For local files, write operations will not overwrite existing data if this flag is specified without FILE_WRITE_DATA.) For a directory object, the right to create a subdirectory (FILE_ADD_SUBDIRECTORY).

DESIRED_ACCESS_FILE_READ_EA0x00000008The right to read extended file attributes.

DESIRED_ACCESS_FILE_WRITE_EA0x00000010The right to write extended file attributes.

DESIRED_ACCESS_FILE_EXECUTE0x00000020For a native code file, the right to execute the file.

This access right given to scripts may cause the script to be executable, depending on the script interpreter.

DESIRED_ACCESS_FILE_DELETE_CHILD0x00000040For a directory, the right to delete a directory and all the files it contains, including read-only files.

DESIRED_ACCESS_FILE_READ_ATTRIBUTES0x00000080The right to read file attributes.

DESIRED_ACCESS_FILE_WRITE_ATTRIBUTES0x00000100The right to write file attributes.

DESIRED_ACCESS_READ_CONTROL0x00020000The right to read the information in the file or directory object's security descriptor.

This does not include the information in the SACL.

DESIRED_ACCESS_STANDARD_RIGHTS_READ0x00020000Includes READ_CONTROL, which is the right to read the information in the file or directory object's security descriptor.

This does not include the information in the SACL.

DESIRED_ACCESS_STANDARD_RIGHTS_WRITE0x00020000Same as STANDARD_RIGHTS_READ

DESIRED_ACCESS_STANDARD_RIGHTS_EXECUTE0x00020000Same as STANDARD_RIGHTS_READ

DESIRED_ACCESS_SYNCHRONIZE0x00100000The right to use the object for synchronization.

This enables a thread to wait until the object is in the signaled state. Some object types do not support this access right.

DESIRED_ACCESS_FILE_ALL_ACCESS0x001F01FFAll possible access rights for a file.

DESIRED_ACCESS_FILE_GENERIC_READ0x00120089A combinarion of flags that allow reading of the file.

Note: Don't match received values against this flag. Instead, use flags that specify the rights that you want to verify or add/remove.

DESIRED_ACCESS_FILE_GENERIC_WRITE0x00120116A combinarion of flags that allow modifications to the file.

Note: Don't match received values against this flag. Instead, use flags that specify the rights that you want to verify or add/remove.

DESIRED_ACCESS_FILE_GENERIC_EXECUTE0x001200A0A combinarion of flags that allow execution of the file.

Note: Don't match received values against this flag. Instead, use flags that specify the rights that you want to verify or add/remove.

Attributes may contain one or more of the following attributes:

FILE_SYS_ATTR_READ_ONLY0x00000001The file is read-only.

Applications can read the file, but cannot write to it or delete it. This attribute is not honored on directories.

FILE_SYS_ATTR_HIDDEN0x00000002The file or directory is hidden.

The file is not included in an ordinary directory listing.

FILE_SYS_ATTR_SYSTEM0x00000004A file or directory that the operating system uses a part of, or uses exclusively.

FILE_SYS_ATTR_DIRECTORY0x00000010The entry is a directory.

FILE_SYS_ATTR_ARCHIVE0x00000020The entry is an archive file or directory.

Applications typically use this attribute to mark files for backup or removal.

FILE_SYS_ATTR_NORMAL0x00000080A file doesn't have other attributes set.

This attribute is valid only when used alone.

FILE_SYS_ATTR_TEMPORARY0x00000100A file that is being used for temporary storage.

File systems avoid writing data back to mass storage if sufficient cache memory is available, because typically, an application deletes a temporary file after the handle is closed. In that scenario, the system can entirely avoid writing the data. Otherwise, the data are written after the handle is closed.

FILE_SYS_ATTR_SPARSE_FILE0x00000200A file that is a sparse file.

FILE_SYS_ATTR_REPARSE_POINT0x00000400A file that is a reparse point or a symbolic link.

FILE_SYS_ATTR_COMPRESSED0x00000800A file or directory that is compressed.

For a file, all of the data in the file are compressed. For a directory, compression is the default for newly created files and subdirectories. A filesystem implementation can make use of this attribute by setting the support_compressed_attribute property to True and then properly handling the on_get_file_info, on_enumerate_directory, and on_set_file_attributes events.

FILE_SYS_ATTR_OFFLINE0x00001000The data of a file are not available immediately.

This attribute indicates that the file data are physically moved to offline storage.

FILE_SYS_ATTR_NOT_CONTENT_INDEXED0x00002000The file or directory is not to be indexed by the content indexing service.

FILE_SYS_ATTR_ENCRYPTED0x00004000A file or directory that is encrypted.

For a file, all data streams in the file are encrypted. For a directory, encryption is the default for newly created files and subdirectories.

Note: This flag is used by NTFS and the OS sends undocumented requests to the filesystem based on this flag. The flag should not be used for files in custom filesystem implementations.

FILE_SYS_ATTR_VIRTUAL0x00010000Reserved.

Note: This flag is reserved by the OS and should not be used for files in custom filesystem implementations.

FILE_SYS_ATTR_RECALL_ON_OPEN0x00040000The file or directory has no physical representation on the local system; the item is virtual.

Opening the item will be more expensive than normal (e.g., it will cause at least some of it to be fetched from a remote store). This flag is reported by filesystems during directory enumerations.

ShareMode may contain zero or more of the following share mode flags:

FILESYS_SHARE_READ0x00000001Enables subsequent open operations on a file or device to request read access.

Enables subsequent open operations to request read access; otherwise, no process can open the file or device if it requests read access. If this flag is not specified, but the file or device has been opened for read access, the function fails.

FILESYS_SHARE_WRITE0x00000002Enables subsequent open operations on a file or device to request write access.

Enables subsequent open operations to request write access; otherwise, no process can open the file or device if it requests write access. If this flag is not specified, but the file or device has been opened for write access or has a file mapping with write access, the function fails.

FILESYS_SHARE_DELETE0x00000004Enables subsequent open operations on a file or device to request delete access.

Enables subsequent open operations to request delete access; otherwise, no process can open the file or device if it requests delete access. If this flag is not specified, but the file or device has been opened for delete access, the function fails.

Note: Delete access allows both delete and rename operations.

CreateDisposition may contain one of the following values:

FILE_DISPOSITION_CREATE_NEW0x00000001Creates a new file, only if it does not already exist.

If the specified file exists, the operation fails with an "already exists" error.

FILE_DISPOSITION_CREATE_ALWAYS0x00000002Creates a new file, always.

If the specified file exists and is writable, the system overwrites the file. If the specified file does not exist and is a valid path, a new file is created.

FILE_DISPOSITION_OPEN_EXISTING0x00000003Opens a file, only if it exists

If the specified file does not exist, opening fails.

FILE_DISPOSITION_OPEN_ALWAYS0x00000004Opens a file, always.

If the specified file exists, the operation succeeds. If the specified file does not exist and is a valid path to a writable location, the a file is created.

FILE_DISPOSITION_TRUNCATE_EXISTING0x00000005Opens a file and truncates it so that its size is zero bytes, only if it exists.

If the specified file does not exist, the operation fails with a "file not found" error.

Options contains the flags that are described in the CreateOptions parameter of the native API's ZwCreateFile function. Most of those flags correspond to flags passed in the FlagsAndAttributes parameter of the Windows API's CreateFile function, but some flags are specific to the native API. If you need those flags, check both functions' descriptions.

Please refer to Microsoft's documentation for detailed information about these constants.

To determine whether the request was for a file or a directory, compare Attributes against the FILE_SYS_ATTR_DIRECTORY constant, as follows: // Check whether the request is for a file or a directory. bool isDirectory = Attributes & FILE_SYS_ATTR_DIRECTORY == FILE_SYS_ATTR_DIRECTORY; FILE_SYS_ATTR_DIRECTORY will be present if it was specified by the calling process or if the existing filesystem entry is a directory.

To determine whether a file will be deleted when its last handle is closed, compare Options against the Windows API's FILE_FLAG_DELETE_ON_CLOSE constant, as follows: // Check whether the file will be deleted on close. bool deleteOnClose = Options & FILE_FLAG_DELETE_ON_CLOSE == FILE_FLAG_DELETE_ON_CLOSE; Note: Because files can be deleted in different ways, do not use this check to take actions related to tracking file deletion operations. Instead, use the events related to file deletion.

When a file or directory is created using the CreateFile() Windows API function, a caller can specify the security descriptor with the security information. This security information should be applied to a newly created file or directory. The class passes this security information in the SecurityInformation and SecurityDescriptor parameters, when the PassSecurityInFileOpenEvents configuration setting is enabled. If this configuration setting is omitted, the corresponding parameters are empty.

The SecurityInformation parameter reflects which pieces of security information, of those present in SecurityDescriptor, are valid and should have been applied. Please refer to Microsoft's SECURITY_INFORMATION data type documentation for more information about possible values.

The SecurityDescriptor parameter points to a memory buffer that contains the security information. The Length parameter reflects the length of this data, in bytes. Please see the Buffer Parameters topic for more information on how to work with memory buffer event parameters.

The data are formatted as a SECURITY_DESCRIPTOR structure in self-relative format; please refer to the Microsoft's documentation for more information.

If the Options contains the FILE_FLAG_DELETE_ON_CLOSE flag, the on_notify_can_file_be_deleted event will fire after this event.

If the file is opened with extended attributes passed in the request, the on_notify_set_ea event will fire after this event.

The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the nt_status_to_win_32_error method.

Note: This event will not fire for failed requests unless the process_failed_requests property is enabled.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

on_notify_query_ea Event

This event fires when information about the extended attributes of a file has been retrieved.

Syntax

class CBMonitorNotifyQueryEaEventParams(object):
  @property
  def file_name() -> str: ...

  @property
  def buffer() -> c_void_p: ...

  @property
  def buffer_length() -> int: ...

  @property
  def return_single_entry() -> bool: ...

  @property
  def ea_list() -> c_void_p: ...

  @property
  def ea_list_length() -> int: ...

  @property
  def ea_index() -> int: ...

  @property
  def restart_scan() -> bool: ...

  @property
  def length_returned() -> int: ...

  @property
  def status() -> int: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_query_ea() -> Callable[[CBMonitorNotifyQueryEaEventParams], None]: ...
@on_notify_query_ea.setter
def on_notify_query_ea(event_hook: Callable[[CBMonitorNotifyQueryEaEventParams], None]) -> None: ...

Remarks

This event fires when information about the extended attributes of a file specified by FileName has been retrieved.

Applications need to handle this event only if they have added a standard filter rule that includes [the TBD]. FS_NE_QUERY_EA flag.

The Buffer parameter points to a memory buffer that, if the request was successful, contains the requested information. The data in the buffer are formatted as a FILE_FULL_EA_INFORMATION structure; please refer to the Microsoft's documentation for more information. The Length parameter reflects the length of this buffer, in bytes. Please see the Buffer Parameters topic for more information on how to work with memory buffer event parameters.

ReturnSingleEntry specifies that the filesystem had to return only the first entry it has found.

EaList is an optional parameter that points to a caller-supplied memory buffer specifying the extended attributes to be queried. The data in the buffer are formatted as a FILE_GET_EA_INFORMATION structure; please refer to the Microsoft's documentation for more information. The EaListLength parameter reflects the length of this data, in bytes. If the caller of the FltQueryEaFile function did not specify any value, it will contain 0.

EaIndex is an optional parameter that specifies the starting index of the attribute, information about which was requested. This parameter is ignored by the filesystem if EaList points to a nonempty list. If the caller of the FltQueryEaFile function did not specify any value, the parameter will contain -1.

The RestartScan parameter instructs the filesystem to restart enumeration of extended attributes from the first entry. If the parameter is False, retrieval of the extended attributes is resumed by the filesystem after a previous request.

LengthReturned is an optional parameter that contains the size, in bytes, of the information, returned in the Buffer.

The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the nt_status_to_win_32_error method.

Note: This event will not fire for failed requests unless the process_failed_requests property is enabled.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

on_notify_query_file_info Event

This event fires when information about a file or directory has been retrieved.

Syntax

class CBMonitorNotifyQueryFileInfoEventParams(object):
  @property
  def file_name() -> str: ...

  @property
  def file_information_class() -> int: ...

  @property
  def buffer() -> c_void_p: ...

  @property
  def buffer_length() -> int: ...

  @property
  def valid_bytes() -> int: ...

  @property
  def status() -> int: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_query_file_info() -> Callable[[CBMonitorNotifyQueryFileInfoEventParams], None]: ...
@on_notify_query_file_info.setter
def on_notify_query_file_info(event_hook: Callable[[CBMonitorNotifyQueryFileInfoEventParams], None]) -> None: ...

Remarks

This event fires when information about a file or directory specified by FileName has been retrieved; This event typically fires in response to the Windows API's NtQueryInformationFile function.

Applications need to handle this event only if they have added a standard filter rule that includes [the TBD]. FS_NE_QUERY_FILE_INFO flag.

The FileInformationClass parameter indicates what kind of file information was requested. Please refer to the NtQueryInformationFile function's documentation for more information about possible values.

The Buffer parameter points to a memory buffer that, if the request was successful, contains the requested file information. The BufferLength and ValidBytes parameters reflect the capacity of Buffer and the length of the data it contains (respectively), in bytes; ValidBytes may be less than BufferLength. Please see the Buffer Parameters topic for more information on how to work with memory buffer event parameters.

The format of the data is determined by the specified FileInformationClass; please refer to the NtQueryInformationFile function's documentation for more information.

The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the nt_status_to_win_32_error method.

Note: This event will not fire for failed requests unless the process_failed_requests property is enabled.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

on_notify_read_file Event

This event fires when data have been read from a file.

Syntax

class CBMonitorNotifyReadFileEventParams(object):
  @property
  def file_name() -> str: ...

  @property
  def position() -> int: ...

  @property
  def bytes_to_read() -> int: ...

  @property
  def direction() -> int: ...

  @property
  def bytes_read() -> int: ...

  @property
  def status() -> int: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_read_file() -> Callable[[CBMonitorNotifyReadFileEventParams], None]: ...
@on_notify_read_file.setter
def on_notify_read_file(event_hook: Callable[[CBMonitorNotifyReadFileEventParams], None]) -> None: ...

Remarks

This event fires when data have been read from a file specified by FileName.

Applications need to handle this event only if they have added a standard filter rule that includes [the TBD]. FS_NE_READ flag.

The Position parameter reflects the byte offset in the file at which reading started.

The BytesToRead parameter reflects how many bytes were to be read from the file.

The Direction parameter indicates the request direction; please refer to the Cached and Non-Cached Requests topic for more information. Possible values are as follows:

FS_REQUEST_DIR_USER_NONCACHED0Operations performed in the user mode application <--> filesystem direction.
FS_REQUEST_DIR_USER_CACHED1Operations performed in the user mode application <--> system cache direction.
FS_REQUEST_DIR_SYSTEM_NONCACHED2Operations performed in the system cache <--> filesystem direction.
FS_REQUEST_DIR_SYSTEM_CACHED3Operations performed in the system component <--> system cache direction.

The BytesRead parameter reflects how many bytes were actually read from the file.

The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the nt_status_to_win_32_error method.

Note: This event will not fire for failed requests unless the process_failed_requests property is enabled.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

on_notify_rename_or_move_file Event

This event fires when a file or directory has been renamed or moved.

Syntax

class CBMonitorNotifyRenameOrMoveFileEventParams(object):
  @property
  def file_name() -> str: ...

  @property
  def new_file_name() -> str: ...

  @property
  def status() -> int: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_rename_or_move_file() -> Callable[[CBMonitorNotifyRenameOrMoveFileEventParams], None]: ...
@on_notify_rename_or_move_file.setter
def on_notify_rename_or_move_file(event_hook: Callable[[CBMonitorNotifyRenameOrMoveFileEventParams], None]) -> None: ...

Remarks

This event fires when a file or directory specified by FileName has been renamed or moved to NewFileName.

Applications need to handle this event only if they have added a standard filter rule that includes [the TBD]. FS_NE_RENAME flag. A rule's mask is matched against both previous and new filenames, and the event will fire when either of the names matches the mask.

The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the nt_status_to_win_32_error method.

Note: This event will not fire for failed requests unless the process_failed_requests property is enabled.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

on_notify_set_allocation_size Event

This event fires when a file's allocation size has been changed.

Syntax

class CBMonitorNotifySetAllocationSizeEventParams(object):
  @property
  def file_name() -> str: ...

  @property
  def allocation_size() -> int: ...

  @property
  def status() -> int: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_set_allocation_size() -> Callable[[CBMonitorNotifySetAllocationSizeEventParams], None]: ...
@on_notify_set_allocation_size.setter
def on_notify_set_allocation_size(event_hook: Callable[[CBMonitorNotifySetAllocationSizeEventParams], None]) -> None: ...

Remarks

This event fires when the allocation size of the file specified by FileName has been changed.

Applications need to handle this event only if they have added a standard filter rule that includes [the TBD]. FS_NE_SET_SIZES flag.

The AllocationSize parameter reflects the new allocation size, in bytes. A file's allocation size is typically larger than its actual size because filesystem operations often reserve space on disk before writing additional data to a file.

The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the nt_status_to_win_32_error method.

Note: This event will not fire for failed requests unless the process_failed_requests property is enabled.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

on_notify_set_ea Event

This event fires when information about the extended attributes of a file has been changed.

Syntax

class CBMonitorNotifySetEaEventParams(object):
  @property
  def file_name() -> str: ...

  @property
  def buffer() -> c_void_p: ...

  @property
  def buffer_length() -> int: ...

  @property
  def status() -> int: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_set_ea() -> Callable[[CBMonitorNotifySetEaEventParams], None]: ...
@on_notify_set_ea.setter
def on_notify_set_ea(event_hook: Callable[[CBMonitorNotifySetEaEventParams], None]) -> None: ...

Remarks

This event fires when information about the extended attributes of a file specified by FileName has been changed.

If the file is created or opened with extended attributes passed in the request, this event will fire shortly after the on_notify_create_file or on_notify_open_file event.

Applications need to handle this event only if they have added a standard filter rule that includes [the TBD]. FS_NE_SET_EA flag.

The Buffer parameter points to a memory buffer that specifies the extended attribute information. The Length parameter reflects the length of this buffer, in bytes. Please see the Buffer Parameters topic for more information on how to work with memory buffer event parameters.

The data are formatted as a FILE_FULL_EA_INFORMATION structure; please refer to the Microsoft's documentation for more information.

The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the nt_status_to_win_32_error method.

Note: This event will not fire for failed requests unless the process_failed_requests property is enabled.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

on_notify_set_file_attributes Event

This event fires when a file or directory's attributes or times have been changed.

Syntax

class CBMonitorNotifySetFileAttributesEventParams(object):
  @property
  def file_name() -> str: ...

  @property
  def creation_time() -> datetime.datetime: ...

  @property
  def last_access_time() -> datetime.datetime: ...

  @property
  def last_write_time() -> datetime.datetime: ...

  @property
  def change_time() -> datetime.datetime: ...

  @property
  def attributes() -> int: ...

  @property
  def status() -> int: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_set_file_attributes() -> Callable[[CBMonitorNotifySetFileAttributesEventParams], None]: ...
@on_notify_set_file_attributes.setter
def on_notify_set_file_attributes(event_hook: Callable[[CBMonitorNotifySetFileAttributesEventParams], None]) -> None: ...

Remarks

This event fires when the attributes or times of the file or directory specified by FileName have been changed.

Applications need to handle this event only if they have added a standard filter rule that includes [the TBD]. FS_NE_SET_ATTRIBUTES flag.

The CreationTime, LastAccessTime, LastWriteTime, and ChangeTime parameters reflect the new time values, specified in UTC. A value of January 1, 1601 00:00:00 UTC indicates that the corresponding time value was not included in the request.

The Attributes parameter reflects the new attributes; please refer to Microsoft's File Attribute Constants article for attribute descriptions.

The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the nt_status_to_win_32_error method.

Note: This event will not fire for failed requests unless the process_failed_requests property is enabled.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

on_notify_set_file_info Event

This event fires when information about a file or directory has been changed.

Syntax

class CBMonitorNotifySetFileInfoEventParams(object):
  @property
  def file_name() -> str: ...

  @property
  def file_information_class() -> int: ...

  @property
  def buffer() -> c_void_p: ...

  @property
  def buffer_length() -> int: ...

  @property
  def valid_bytes() -> int: ...

  @property
  def status() -> int: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_set_file_info() -> Callable[[CBMonitorNotifySetFileInfoEventParams], None]: ...
@on_notify_set_file_info.setter
def on_notify_set_file_info(event_hook: Callable[[CBMonitorNotifySetFileInfoEventParams], None]) -> None: ...

Remarks

This event fires when information about a file or directory specified by FileName has been changed; This event typically fires in response to the Windows API's NtSetInformationFile function.

Applications need to handle this event only if they have added a standard filter rule that includes [the TBD]. FS_NE_QUERY_FILE_INFO flag.

The FileInformationClass parameter indicates what kind of file information was set. Please refer to the NtSetInformationFile function's documentation for more information about possible values.

The Buffer parameter points to a memory buffer that, if the request was successful, contains the new file information. The BufferLength and ValidBytes parameters reflect the capacity of Buffer and the length of the data it contains (respectively), in bytes; ValidBytes may be less than BufferLength. Please see the Buffer Parameters topic for more information on how to work with memory buffer event parameters.

The format of the data is determined by the specified FileInformationClass; please refer to the NtSetInformationFile function's documentation for more information.

The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the nt_status_to_win_32_error method.

Note: This event will not fire for failed requests unless the process_failed_requests property is enabled.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

on_notify_set_file_security Event

This event fires when a file or directory's security attributes have been changed.

Syntax

class CBMonitorNotifySetFileSecurityEventParams(object):
  @property
  def file_name() -> str: ...

  @property
  def security_information() -> int: ...

  @property
  def security_descriptor() -> c_void_p: ...

  @property
  def length() -> int: ...

  @property
  def status() -> int: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_set_file_security() -> Callable[[CBMonitorNotifySetFileSecurityEventParams], None]: ...
@on_notify_set_file_security.setter
def on_notify_set_file_security(event_hook: Callable[[CBMonitorNotifySetFileSecurityEventParams], None]) -> None: ...

Remarks

This event fires when security attributes have been changed for a file or directory specified by FileName.

Applications need to handle this event only if they have added a standard filter rule that includes [the TBD]. FS_NE_SET_SECURITY flag.

The SecurityInformation parameter reflects which pieces of security information, of those present in SecurityDescriptor, were to be set. Please refer to Microsoft's SECURITY_INFORMATION data-type documentation for more information about possible values.

The SecurityDescriptor parameter points to a memory buffer that contains the new security information. The Length parameter reflects the length of this data, in bytes. Please see the Buffer Parameters topic for more information on how to work with memory buffer event parameters.

The data are formatted as a SECURITY_DESCRIPTOR structure in self-relative format; please refer to the Microsoft's documentation for more information.

The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the nt_status_to_win_32_error method.

Note: This event will not fire for failed requests unless the process_failed_requests property is enabled.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

on_notify_set_file_size Event

This event fires when a file has been resized.

Syntax

class CBMonitorNotifySetFileSizeEventParams(object):
  @property
  def file_name() -> str: ...

  @property
  def size() -> int: ...

  @property
  def status() -> int: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_set_file_size() -> Callable[[CBMonitorNotifySetFileSizeEventParams], None]: ...
@on_notify_set_file_size.setter
def on_notify_set_file_size(event_hook: Callable[[CBMonitorNotifySetFileSizeEventParams], None]) -> None: ...

Remarks

This event fires when the file specified by FileName has been resized, whether explicitly (e.g., truncation) or implicitly (i.e., as data are appended).

Applications need to handle this event only if they have added a standard filter rule that includes [the TBD]. FS_NE_SET_SIZES flag.

The Size parameter reflects the new file size, in bytes.

The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the nt_status_to_win_32_error method.

Note: This event will not fire for failed requests unless the process_failed_requests property is enabled.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

on_notify_set_reparse_point Event

This event fires when a file or directory's reparse point has been created or updated.

Syntax

class CBMonitorNotifySetReparsePointEventParams(object):
  @property
  def file_name() -> str: ...

  @property
  def reparse_tag() -> int: ...

  @property
  def status() -> int: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_set_reparse_point() -> Callable[[CBMonitorNotifySetReparsePointEventParams], None]: ...
@on_notify_set_reparse_point.setter
def on_notify_set_reparse_point(event_hook: Callable[[CBMonitorNotifySetReparsePointEventParams], None]) -> None: ...

Remarks

This event fires when a reparse point has been created or updated for a file or directory specified by FileName.

Applications need to handle this event only if they have added a standard filter rule that includes [the TBD]. FS_NE_SET_REPARSE_POINT flag.

The ReparseTag parameter contains the reparse tag, which is the value the system uses to identify the format of the reparse point data.

The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the nt_status_to_win_32_error method.

Note: This event will not fire for failed requests unless the process_failed_requests property is enabled.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

on_notify_unlock_all Event

This event fires when all locked byte ranges in a file have been unlocked.

Syntax

class CBMonitorNotifyUnlockAllEventParams(object):
  @property
  def file_name() -> str: ...

  @property
  def status() -> int: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_unlock_all() -> Callable[[CBMonitorNotifyUnlockAllEventParams], None]: ...
@on_notify_unlock_all.setter
def on_notify_unlock_all(event_hook: Callable[[CBMonitorNotifyUnlockAllEventParams], None]) -> None: ...

Remarks

This event fires when all locked byte ranges in the file specified by FileName have been unlocked.

Applications need to handle this event only if they have added a standard filter rule that includes [the TBD]. FS_NE_LOCK_CONTROL flag.

The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the nt_status_to_win_32_error method.

Note: This event will not fire for failed requests unless the process_failed_requests property is enabled.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

on_notify_unlock_all_by_key Event

This event fires when all locked byte ranges in a file, associated with a particular key, have been unlocked.

Syntax

class CBMonitorNotifyUnlockAllByKeyEventParams(object):
  @property
  def file_name() -> str: ...

  @property
  def key() -> int: ...

  @property
  def status() -> int: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_unlock_all_by_key() -> Callable[[CBMonitorNotifyUnlockAllByKeyEventParams], None]: ...
@on_notify_unlock_all_by_key.setter
def on_notify_unlock_all_by_key(event_hook: Callable[[CBMonitorNotifyUnlockAllByKeyEventParams], None]) -> None: ...

Remarks

This event fires when all locked byte ranges in the file specified by FileName, and associated with the specified Key, have been unlocked.

Applications need to handle this event only if they have added a standard filter rule that includes [the TBD]. FS_NE_LOCK_CONTROL flag.

The Key parameter contains the key value specified when the byte ranges were locked. Please refer to the on_notify_lock event's documentation for more information.

The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the nt_status_to_win_32_error method.

Note: This event will not fire for failed requests unless the process_failed_requests property is enabled.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

on_notify_unlock_single Event

This event fires when a particular locked byte range in a file has been unlocked.

Syntax

class CBMonitorNotifyUnlockSingleEventParams(object):
  @property
  def file_name() -> str: ...

  @property
  def offset() -> int: ...

  @property
  def length() -> int: ...

  @property
  def key() -> int: ...

  @property
  def status() -> int: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_unlock_single() -> Callable[[CBMonitorNotifyUnlockSingleEventParams], None]: ...
@on_notify_unlock_single.setter
def on_notify_unlock_single(event_hook: Callable[[CBMonitorNotifyUnlockSingleEventParams], None]) -> None: ...

Remarks

This event fires when a particular locked byte range in a file specified by FileName has been unlocked.

Applications need to handle this event only if they have added a standard filter rule that includes [the TBD]. FS_NE_LOCK_CONTROL flag.

The Offset, Length, and Key parameters contain the starting byte offset, length, and key values, respectively, specified when the byte range was locked. Please refer to the on_notify_lock event's documentation for more information.

The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the nt_status_to_win_32_error method.

Note: This event will not fire for failed requests unless the process_failed_requests property is enabled.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

on_notify_write_file Event

This event fires when data have been written to a file.

Syntax

class CBMonitorNotifyWriteFileEventParams(object):
  @property
  def file_name() -> str: ...

  @property
  def position() -> int: ...

  @property
  def bytes_to_write() -> int: ...

  @property
  def direction() -> int: ...

  @property
  def bytes_written() -> int: ...

  @property
  def status() -> int: ...

  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_notify_write_file() -> Callable[[CBMonitorNotifyWriteFileEventParams], None]: ...
@on_notify_write_file.setter
def on_notify_write_file(event_hook: Callable[[CBMonitorNotifyWriteFileEventParams], None]) -> None: ...

Remarks

This event fires when data have been written to the file specified by FileName.

Applications need to handle this event only if they have added a standard filter rule that includes [the TBD]. FS_NE_WRITE flag.

The Position parameter reflects the byte offset in the file at which writing started. A value of -1 means "append to the end of the file".

The BytesToWrite parameter reflects how many bytes were to be written to the file.

The Direction parameter indicates the request direction; please refer to the Cached and Non-Cached Requests topic for more information. Possible values are as follows:

FS_REQUEST_DIR_USER_NONCACHED0Operations performed in the user mode application <--> filesystem direction.
FS_REQUEST_DIR_USER_CACHED1Operations performed in the user mode application <--> system cache direction.
FS_REQUEST_DIR_SYSTEM_NONCACHED2Operations performed in the system cache <--> filesystem direction.
FS_REQUEST_DIR_SYSTEM_CACHED3Operations performed in the system component <--> system cache direction.

The BytesWritten parameter reflects how many bytes were actually written to the file.

The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the nt_status_to_win_32_error method.

Note: This event will not fire for failed requests unless the process_failed_requests property is enabled.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error.

Note: This event fires after the operation has already completed, so reporting an error will not actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.

on_worker_thread_creation Event

Fires just after a new worker thread is created.

Syntax

class CBMonitorWorkerThreadCreationEventParams(object):
  @property
  def result_code() -> int: ...
  @result_code.setter
  def result_code(value) -> None: ...

# In class CBMonitor:
@property
def on_worker_thread_creation() -> Callable[[CBMonitorWorkerThreadCreationEventParams], None]: ...
@on_worker_thread_creation.setter
def on_worker_thread_creation(event_hook: Callable[[CBMonitorWorkerThreadCreationEventParams], None]) -> None: ...

Remarks

This event fires just after a worker thread is created, in the context of that worker thread.

This event is optional; it is provided to give applications a chance to perform additional processing when a new worker thread is created, such as allocating per-thread objects.

The class maintains a pool of worker threads and uses them to fire events; please refer to the Threading and Concurrency topic for more information.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason (e.g., a resource is not available or security checks failed), set it to a nonzero value to report an appropriate error. Please see the Error Reporting and Handling topic for more information.

This event is fired synchronously; please refer to the Event Types topic for more information.

on_worker_thread_termination Event

Fires just before a worker thread is terminated.

Syntax

class CBMonitorWorkerThreadTerminationEventParams(object):
# In class CBMonitor:
@property
def on_worker_thread_termination() -> Callable[[CBMonitorWorkerThreadTerminationEventParams], None]: ...
@on_worker_thread_termination.setter
def on_worker_thread_termination(event_hook: Callable[[CBMonitorWorkerThreadTerminationEventParams], None]) -> None: ...

Remarks

This event fires just before a worker thread is terminated, in the context of that worker thread.

This event is optional; it is provided to give applications a chance to perform additional processing before a worker thread is terminated, such as deallocating per-thread objects.

The class maintains a pool of worker threads and uses them to fire events; please refer to the Threading and Concurrency topic for more information.

Any errors that occur during this event are ignored.

This event is fired synchronously; please refer to the Event Types topic for more information.

CBMonitor Config Settings

The class accepts one or more of the following configuration settings. Configuration settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the config method.

CBMonitor Config Settings

AlwaysPrepareFiles:   Whether the driver should keep track of information for files that are already open when (i.e., were opened before) the class is initialized.

This setting corresponds to the INSTALL_ALWAYS_PREPARE_FILES flag, which is used with the install method. Please refer to the documentation for both for more information. If this setting is enabled when install is called, the aforementioned flag will be set automatically.

Administrative rights are required to change this configuration setting after initialize is called. If the user account of the process that calls config does not have such rights, the call will fail with an ERROR_PRIVILEGE_NOT_HELD (0x0522) error.

AlwaysRequestAttributesOnOpen:   Whether the driver should keep request existing attributes before file create/open operation.

Normally, the driver requests existing attributes of the file or directory that is created or opened only when extended rules are set. This setting is disabled by default.

Enable this setting to tell the driver to always request the existing attributes and pass them to the ExistingAttributes parameter of the events, as related to file creation and opening.

CollectRemoteOpenInformation:   Enables collection of information about remote filesystem requests.

This information includes an address of the client and the name of the share through which the access was made.

By default, this configuration setting is disabled. Enable it to use the get_remote_access_information method.

FilterOwnRequests:   Whether the class's system driver should filter requests made by the application itself.

This configuration setting specifies whether requests made by the application should be filtered through the class's system driver (assuming that they match one of the rules present at the time). When this setting is disabled (default), and the application performs some operation that would match an existing rule, the driver will explicitly ignore it.

Normally, this setting should remain disabled (especially in production) to reduce the possibility of system deadlocks occurring. Certain situations, however, do require it to be enabled, such as for testing purposes (so that event handlers can be tested with single-process tests).

ForceAppPermissionCheck:   Whether the driver should require the controller process to have elevated or system privileges.

This configuration setting corresponds to the INSTALL_FORCE_APP_PERMISSION_CHECK flag, which is used with the install method; please refer to the documentation for both for more information. If this setting is enabled when install is called, the aforementioned flag will be set automatically.

Administrative rights are required to change this configuration setting after initialize is called. If the user account of the process that calls config does not have such rights, the call will fail with an ERROR_PRIVILEGE_NOT_HELD (0x0522) error.

ForceSecurityChecks:   Whether the driver should prevent the controller process from filtering files that it would not normally have access to.

This configuration setting corresponds to the INSTALL_FORCE_SECURITY_CHECKS flag, which is used with the install method; please refer to the documentation for both for more information. If this setting is enabled when install is called, the aforementioned flag will be set automatically.

Administrative rights are required to change this configuration setting after initialize is called. If the user account of the process that calls config does not have such rights, the call will fail with an ERROR_PRIVILEGE_NOT_HELD (0x0522) error.

LoggingEnabled:   Whether extended logging is enabled.

This setting specifies whether extended logging is enabled for this class; it is disabled by default. Please refer to the Error Reporting and Handling topic for more information.

This setting's value is stored in the registry and is persistent; it requires administrative rights to be changed.

MaxWorkerThreadCount:   The maximum number of worker threads to use to fire events.

This setting specifies the maximum number of worker threads the class may create to fire events on when the serialize_events property is set to seOnMultipleThreads. (If other cases, this setting does not apply.)

By default, this setting is set to 0, and the driver automatically chooses an optimal number of threads using this equation: 4 * number_of_processors.

MinWorkerThreadCount:   The minimum number of worker threads to use to fire events.

This setting specifies the minimum number of worker threads the class should create to fire events on when the serialize_events property is set to seOnMultipleThreads. (In other cases, this setting does not apply.)

By default, this setting is set to 0, and the driver automatically chooses an optimal number of threads using this equation: max(number_of_processors, 4). If this setting's value exceeds the MaxWorkerThreadCount value, the latter is used instead.

OmitEventFilenames:   Whether the filename parameter should be empty in events.

In some editions of the product, passing an extra string parameter to events involves extra allocation of memory and is an unnecessary expenditure of CPU cycles. Enabling this setting makes the component skip passing the filename to event handlers. Event handlers can obtain the file or directory name by calling the get_event_filename method.

By default this setting is disabled.

Note: This setting cannot be changed when active is True, and it cannot be changed within events.

PassSecurityInFileOpenEvents:   Whether security information, associated with the file create/open request, is passed to file creation and opening events.

This setting specifies whether the security descriptor, passed by the originator of file creation or opening request to the CreateFile() or similar Windows API function, should be passed to various *FileCreate/*FileOpen events. This setting is disabled by default for performance reasons.

Note: This setting cannot be changed within events.

PreprocessedRulesCacheSize:   Maximum number of preprocessed rules to keep cached.

This configuration setting specifies the maximum number of preprocessed rules that the class's system driver should keep cached; it is set to 1024 by default.

When a file or directory is first opened, the class's system driver determines which of the currently active rules it matches, if any. The results of this process are collected into a single preprocessed rule internally, which is then cached. These preprocessed rules can provide significant performance improvements, especially if many rules have been added, because they prevent the driver from having to recheck each rule every time an operation occurs.

RecordOperationTime:   Enables collection of operation time.

By default, this configuration setting is disabled and the driver does not record the time of each operation. If the application needs to use the get_operation_time method, it must enable this setting.

ResolveNtDeviceToDriveLetter:   Whether native device names are translated to drive letters.

This configuration setting specifies whether NT native device names, like \Device\HarddiskVolume1\..., should be translated to DOS-style drive letters, like C:\... when possible. However, please note the following:

  • Such translation will be performed only if a device actually has a corresponding DOS-style drive letter; not all devices do.
  • The on_before_filter_attach_to_volume event always uses NT native device names, because DOS-style drive letters are not assigned until after it fires.

This setting is enabled by default; it can be disabled to improve performance, or if the application needs the native device name.

Note: This setting cannot be changed when active is True, and it cannot be changed within events.

SendRequestsViaDriverStack:   Whether internal requests to the filesystem are sent directly to the filesystem driver or through the stack of filesystem filter drivers.

This configuration setting corresponds to the INSTALL_REQUESTS_VIA_DRIVER_STACK flag, which is used with the install method; please refer to the documentation for more information. If this setting is enabled when install is called, the aforementioned flag will be set automatically.

Administrative rights are required to change this configuration setting after initialize is called. If the user account of the process that calls config does not have such rights, the call will fail with an ERROR_PRIVILEGE_NOT_HELD (0x0522) error.

WorkerInitialStackSize:   The initial stack size to create worker threads with.

This setting specifies the initial size of the stack each worker thread is created with. The system rounds this value to the nearest page.

By default, this setting is set to 0, and the driver uses a default stack size (currently, 1 MB).

Note: This setting cannot be changed when active is True, and it cannot be changed within events.

Base Config Settings

BuildInfo:   Information about the product's build.

When queried, this setting will return a string containing information about the product's build.

LicenseInfo:   Information about the current license.

When queried, this setting will return a string containing information about the license this instance of a class is using. It will return the following information:

  • Product: The product the license is for.
  • Product Key: The key the license was generated from.
  • License Source: Where the license was found (e.g., RuntimeLicense, License File).
  • License Type: The type of license installed (e.g., Royalty Free, Single Server).

CBMonitor Errors

The class uses Windows error codes during operation as necessary. Please refer to the Error Reporting and Handling topic for more information.

Special Use Errors

21   ERROR_NOT_READY: Reported by the methods of the class if initialize has not been called or did not succeed.
575   ERROR_APP_INIT_FAILURE: Reported by the methods of the class if initialize has not been called or did not succeed. Differs from ERROR_NOT_READY (21) in that it indicates a specific situation in the internal code.
588   ERROR_FS_DRIVER_REQUIRED: Reported if the required system module was not correctly installed for the given ProductGUID.
614   ERROR_NO_CALLBACK_ACTIVE: Reported by any method that can only be called within event handlers if it is called outside an event handler.
1292   ERROR_IMPLEMENTATION_LIMIT: Reported when the timeout value provided is less than 3 seconds.
1314   ERROR_PRIVILEGE_NOT_HELD: Reported by any method that requires elevated permissions if it is called without such permissions.