Constants
All constants are accessible through the cbfsfilter.Constants class.
No access restrictions.
Read-only access; writing and deleting are prohibited.
Write-only access; reading and deleting are prohibited.
Deleting and renaming are prohibited.
Execution is prohibited.
Change of security attributes is prohibited.
Change of owner is prohibited.
Renaming is prohibited.
Deleting is prohibited (renaming is not affected).
Access from other systems is prohibited.
All access is denied.
Used to denote all currently set access restriction flags.
Don't fire for any filesystem operations.
Control Events will not fire for any filesystem operations.
Fire before file creation operations.
The BeforeCreateFile event will fire anytime the OS attempts to create a file or directory.
In some cases, this event can cause the BeforeOpenFile event to fire; refer to the File Create/Open Events topic for more information.
Fire after file creation operations.
The AfterCreateFile event will fire after a file or directory creation request has been processed, before the response is returned.
In some cases, this event can cause the AfterOpenFile event to fire; refer to the File Create/Open Events topic for more information.
Fire before file open operations.
The BeforeOpenFile event will fire anytime the OS attempts to open a file or directory.
In some cases, this event can cause the BeforeCreateFile event to fire; refer to the File Create/Open Events topic for more information.
Fire after file open operations.
The AfterOpenFile event will fire after a file or directory open request has been processed, before the response is returned.
In some cases, this event can cause the AfterCreateFile event to fire; refer to the File Create/Open Events topic for more information.
Fire before read operations.
The BeforeReadFile event will fire anytime the OS attempts to read data from a file.
Fire after read operations.
The AfterReadFile event will fire after a read request has been processed, before the response is returned.
Fire before write operations.
The BeforeWriteFile event will fire anytime the OS attempts to write data to a file.
Fire after write operations.
The AfterReadFile event will fire after a write request has been processed, before the response is returned.
Fire before lock and unlock operations.
The BeforeLock, BeforeUnlockAll, BeforeUnlockAllByKey, and BeforeUnlockSingle events will fire, as applicable, before the OS attempts to lock or unlock a range of bytes in a file.
Fire before and after lock and unlock operations.
The AfterLock, AfterUnlockAll, AfterUnlockAllByKey, and AfterUnlockSingle, events will fire, as applicable, after a lock or unlock request has been processed, before the response is returned.
Fire before file handle cleanup operations.
The BeforeCleanupFile event will fire anytime a process closes a file or directory handle.
Fire after file handle cleanup operations.
The AfterCleanupFile event will fire after a file handle cleanup request has been processed, before the response is returned.
Fire before file close operations.
The BeforeCloseFile event will fire anytime the OS closes a file or directory. Also, the AfterCloseEnumeration event will fire anytime the OS closes a directory enumeration (which typically occurs immediately before the directory is closed).
Fire after file close operations.
The AfterCloseFile event will fire after a file/directory close request has been processed, before the response is returned.
Fire before 'can be deleted' operations.
The BeforeCanFileBeDeleted event will fire anytime the OS checks whether a file or directory can be deleted.
Fire after 'can be deleted' operations.
The AfterCanFileBeDeleted event will fire after a can be deleted request has been processed, before the response is returned.
Fire before delete operations
The BeforeDeleteFile event will fire anytime the OS attempts to delete a file or directory.
Fire after delete operations.
The AfterDeleteFile event will fire after a delete request has been processed, before the response is returned.
Fire before rename/move operations.
The BeforeRenameOrMoveFile event will fire anytime the OS attempts to rename or move a file or directory.
Fire after rename/move operations.
The AfterRenameOrMoveFile event will fire after a rename or move request has been processed, before the response is returned.
Fire before get security operations.
The BeforeGetFileSecurity event will fire before the OS queries the security attributes of a file or directory.
Fire after get security operations.
The AfterGetFileSecurity events will fire after a get security operation has been processed, before the response is returned.
Fire before directory enumeration operations.
The BeforeEnumerateDirectory event will fire anytime the OS needs to read information about directory entries.
Fire after directory enumeration operations.
The AfterEnumerateDirectory event will fire after information about a directory entry has been retrieved during directory enumeration, before the response is returned.
Fire before 'query file information' operations.
The BeforeQueryFileInfo event will fire anytime the OS needs to retrieve information about a file or directory.
Fire after 'query file information' operations.
The AfterQueryFileInfo event will fire after a file or directory information query request has been processed, before the response is returned.
Fire after get size operations.
The AfterGetFileSizes event will fire after a file's size information is retrieved, before the response is returned.
Fire before set security operations.
The BeforeSetFileSecurity event will fire anytime the OS needs to change the security attributes of a file or directory.
Fire after set security operations.
The AfterSetFileSecurity event will fire after a security attribute change request has been processed, before the response is returned.
Fire before file attribute update operations.
The BeforeSetFileAttributes event will fire anytime the OS attempts to change the attributes of a file or directory.
Fire after file attribute update operations.
The AfterSetFileAttributes event will fire after a file attribute change request has been processed, before the response is returned.
Fire before file resize operations.
The BeforeSetFileSize event will fire anytime the OS attempts to resize a file,
and the BeforeSetAllocationSize event will fire anytime the OS attempts to change a file's allocation size.
Fire after file resize operations.
The AfterSetFileSize event will fire after a file resize request has been processed, and the AfterSetAllocationSize event will fire after a file allocation size change request has been processed,
before the response is returned.
Fire before hard link creation operations.
The BeforeCreateHardLink event will fire anytime the OS attempts to create a hard link.
Fire after hard link creation operations.
The AfterCreateHardLink events will fire after a hard link creation request has been processed, before the response is returned.
Fire before FSCTL operations.
The BeforeFsctl event will fire anytime an IRP_MJ_FILE_SYSTEM_CONTROL request occurs.
Fire after FSCTL operations.
The AfterFsctl event will fire after an IRP_MJ_FILE_SYSTEM_CONTROL request has been processed, before the response is returned.
Fire before IOCTL operations.
The BeforeIoctl event will fire anytime an IRP_MJ_DEVICE_CONTROL request occurs.
Fire after IOCTL operations.
The AfterIoctl event will fire after an IRP_MJ_DEVICE_CONTROL request has been processed, before the response is returned.
Fire before 'set file information' operations.
The BeforeSetFileInfo event will fire anytime the OS needs to change information about a file or directory.
Fire after 'set file information' operations.
The AfterSetFileInfo event will fire after a file or directory information change request has been processed, before the response is returned.
Fire before Set Extended Attributes operations.
The BeforeSetEa event will fire anytime the OS needs to set extended attributes of a file.
Fire after Set Extended Attributes operations.
The AfterSetEa event will fire after the OS request to set extended attributes of a file has been processed, before the response is returned.
Fire before Query Extended Attributes operations.
The BeforeQueryEa event will fire anytime the OS needs to retrieve extended attributes of a file.
Fire after Query Extended Attributes operations.
The AfterQueryEa event will fire after the OS request to retrieve extended attributes of a file has been processed, before the response is returned.
Fire before Get Reparse Point operations.
The BeforeGetReparsePoint event will fire anytime the OS needs to read a reparse point of a file or directory.
Fire after Get Reparse Point operations.
The AfterGetReparsePoint event will fire after the OS request to read a reparse point of a file or directory has been processed, before the response is returned.
Fire before Set Reparse Point operations.
The BeforeSetReparsePoint event will fire anytime the OS needs to set or update a reparse point for a file or directory.
Fire after Set Reparse Point operations.
The AfterSetReparsePoint event will fire after the OS request to set or update a reparse point for a file or directory has been processed, before the response is returned.
Fire before Delete Reparse Point operations.
The BeforeDeleteReparsePoint event will fire anytime the OS needs to remove reparse point information from a file or directory.
Fire after Delete Reparse Point operations.
The AfterDeleteReparsePoint event will fire after the OS request to remove reparse point information from a file or directory has been processed, before the response is returned.
Fire before various operations for the purpose of file redirection.
The ReparseFileName event will fire before any operation that includes a file or directory name, giving the application a chance to redirect it.
This event is typically used when an application requires more advanced redirection logic than Reparse Rules can provide; please refer to that topic for more information.
Fire for reparse operations.
The ReparseWithTag event will fire anytime a file/directory open operation returns a STATUS_REPARSE result, allowing the application to handle the reparse point.
Please refer to Microsoft's Reparse Points article for more information.
Fire for all filesystem operations.
Control Events will fire for all filesystem operations that the class tracks.
Don't fire for any filesystem operations.
Notification Events will not fire for any filesystem operations.
Fire for file creation operations.
The NotifyCreateFile event will fire anytime the OS creates a file or directory.
In some cases, this event can cause the NotifyOpenFile event to fire; refer to the File Create/Open Events topic for more information.
Fire for file open operations.
The NotifyOpenFile event will fire anytime the OS opens a file or directory.
In some cases, this event can cause the NotifyCreateFile event to fire; refer to the File Create/Open Events topic for more information.
Fire for read operations.
The NotifyReadFile event will fire anytime the OS reads data from a file.
Fire for write operations.
The NotifyWriteFile event will fire anytime the OS writes data to a file.
Fire for lock and unlock operations.
The NotifyLock, NotifyUnlockAll, NotifyUnlockAllByKey, and NotifyUnlockSingle events will fire, as applicable, anytime the OS locks or unlocks a range of bytes in a file.
Fire for file handle cleanup operations.
The NotifyCleanupFile event will fire anytime a process closes a file or directory handle.
Fire for file close operations.
The NotifyCloseFile event will fire anytime the OS closes a file or directory.
Fire for 'can be deleted' operations.
The NotifyCanFileBeDeleted event will fire anytime the OS checks whether or not a file or directory can be deleted.
Fire for delete operations.
The NotifyDeleteFile event will fire anytime the OS deletes a file or directory.
Fire for rename/move operations.
The NotifyRenameOrMoveFile event will fire anytime the OS renames or moves a file or directory.
Fire for get security operations.
The NotifyGetFileSecurity event will fire anytime the OS queries the security attributes of a file or directory.
Fire for directory enumeration operations.
The NotifyEnumerateDirectory event will fire anytime the OS retrieves a directory entry during directory enumeration.
Fire for QueryFileInformation operations.
The NotifyQueryFileInfo event will fire anytime the OS retrieves information about a file or directory.
Fire for get size operations.
The NotifyGetFileSizes event will fire anytime the OS retrieves a file's size information.
Fire for set security operations.
The NotifySetFileSecurity event will fire anytime the OS changes the security attributes of a file or directory.
Fire for file attribute update operations.
The NotifySetFileAttributes event will fire anytime the OS changes the attributes of a file or directory.
Fire for file resize operations.
The NotifySetFileSize event will fire anytime the OS resizes a file, and the NotifySetAllocationSize event will fire anytime the OS changes a file's allocation size.
Fire for hard link creation operations.
The NotifyCreateHardLink event will fire anytime the OS creates a hard link.
Fire for FSCTL operations.
The NotifyFsctl event will fire anytime an IRP_MJ_FILE_SYSTEM_CONTROL operation occurs.
Fire for IOCTL operations.
The NotifyIoctl event will fire anytime an IRP_MJ_DEVICE_CONTROL operation occurs.
Fire for SetFileInformation operations.
The NotifySetFileInfo event will fire anytime the OS changes information about a file or directory.
Fire for Set Extended Attributes operations.
The NotifySetEa event will fire anytime the OS sets extended attributes of a file.
Fire for Query Extended Attributes operations.
The NotifyQueryEa event will fire anytime the OS retrieves extended attributes of a file.
Fire for Get Reparse Point operations.
The NotifyGetReparsePoint event will fire anytime the OS reads reparse point information of a file or directory.
Fire for Set Reparse Point operations.
The NotifySetReparsePoint event will fire anytime the OS sets or updates reparse point information for a file or directory.
Fire for Delete Reparse Point operations.
The NotifyDeleteReparsePoint event will fire anytime the OS deletes reparse point information from a file or directory.
Fire for BypassIO operations.
The BypassIORequest event will fire anytime the OS sends a BypassIO request related to some file.
This flag should be passed with notification flags, even though the event is synchronous.
Fire for all filesystem operations.
Notification Events will fire for all filesystem operations that the class tracks.
The requestor specified that directory enumeration must be restarted.
One entry should be returned.
The requestor specified the index to start enumeration from.
Perform redirection by modifying the path directly using the CBFilter system driver.
Perform redirection by having the CBFilter system driver emulate real reparse point behavior.
This option will cause the driver to report that a file or directory's parent directory is a reparse point of the SYMLINK variety.
Redirection performed in this manner is more consistent with Windows' behavior; however, some software may fail to correctly handle paths that cross such symbolic links.
Operations performed in the user mode application <--> filesystem direction.
Operations performed in the user mode application <--> system cache direction.
Operations performed in the system cache <--> filesystem direction.
Operations performed in the system component <--> system cache direction.
Don't fire any events when volumes are mounted or unmounted.
Fire Notification Events when volumes are mounted or unmounted.
The NotifyFilterAttachToVolume and NotifyFilterDetachFromVolume events will fire, asynchronously, as necessary.
Fire Control Events when volumes are mounted or unmounted.
The BeforeFilterAttachToVolume, AfterFilterAttachToVolume, and AfterFilterDetachFromVolume events will fire, synchronously, as necessary.
Fire all events when volumes are mounted or unmounted.
Whether memory-mapped file data should be flushed to disk before files are opened.
This flag indicates that the class's system driver should flush any cached and memory-mapped file data, leftover from the last time a file was opened, before opening it again.
Doing so ensures that file data are read directly from the disk rather than from the old memory mapping.
Whether file buffers must be flushed when files are closed.
This flag indicates that the class's system driver should flush and clear the buffers of files that are opened for writing (and have had data written to them) when they are closed.
Whether files opened for writing must be closed when the application stops filtering.
This flag indicates that the class's system driver should close files that are opened for writing (and have had data written to them) when the application calls StopFilter.
Whether file buffers must be flushed when the application stops filtering.
This flag indicates that the class's system driver should flush and clear the buffers of files that are opened for writing (and have had data written to them) when the application calls StopFilter.
Whether files opened for writing must be closed if the application terminates unexpectedly.
This flag indicates that the class's system driver should close files that are opened for writing (and have had data written to them) if the driver detects that the application has terminated.
Whether file buffers must be flushed if the application terminates unexpectedly.
This flag indicates that the class's system driver should flush and clear the buffers of files that are opened for writing (and have had data written to them) if the driver detects that the application has terminated.
Combination of flags suitable for on-the-fly file encryption applications.
This option includes the following flags: FS_FLUSH_FILES_ON_OPEN, FS_FLUSH_FILES_ON_CLOSE, FS_CLOSE_FILES_ON_STOPFILTER, FS_FLUSH_FILES_ON_STOPFILTER, and FS_CLOSE_FILES_ON_CRASH flags.
The file or directory is opened with the FILE_FLAG_DELETE_ON_CLOSE flag
The system has sent the IRP_MJ_SET_INFORMATION request with SetFileDisposition structure as a parameter.
This request usually is sent using the NtSetInformationFile() Windows native API function.
Don't fire for any process operations.
Events will not fire for any process operations.
Fire during process creation operations.
The ProcessCreation event will fire anytime the OS attempts to create a process.
Fire during process closing/termination.
The ProcessTermination event will fire when a process is being terminated.
Fire during process handle creation or duplication.
The ProcessHandleOperation event will fire when a process handle is being created or duplicated.
Fire during thread creation operations.
The ThreadCreation event will fire when a thread is being created, before it is started.
Fire during thread termination operations.
The ThreadTermination event will fire when a thread is being terminated.
Fire during thread handle creation or duplication.
The ThreadHandleOperation event will fire when a thread handle is being created or duplicated.
Fire for all process and thread operations.
Events will fire for all thread operations.
Don't fire for any registry operations.
Control Events will not fire for any registry operations.
Fire before registry key creation operations.
The BeforeCreateKey event will fire anytime the OS attempts to create a registry key.
Fire after registry key creation operations.
The AfterCreateKey event will fire after a registry key creation request has been processed, before the response is returned.
Fire before registry key open operations.
The BeforeOpenKey event will fire anytime the OS attempts to open a registry key.
Fire after registry key open operations.
The AfterOpenKey event will fire after a registry key open request has been processed, before the response is returned.
Fire before registry key close operations.
The BeforeCloseKey event will fire anytime the OS closes a registry key.
Fire after registry key close operations.
The AfterCloseKey event will fire after a registry key close request has been processed, before the response is returned.
Fire before registry key delete operations.
The BeforeDeleteKey event will fire anytime the OS attempts to delete a registry key.
Fire after registry key delete operations.
The AfterDeleteKey event will fire after a registry key delete request has been processed, before the response is returned.
Fire before registry key rename operations.
The BeforeRenameKey event will fire anytime the OS attempts to rename a registry key.
Fire after registry key rename operations.
The AfterRenameKey event will fire after a registry key rename request has been processed, before the response is returned.
Fire before subkey enumeration operations.
The BeforeEnumerateKey event will fire anytime the OS attempts to enumerate a registry key's subkeys.
Fire after subkey enumeration operations.
The AfterEnumerateKey event will fire after a subkey enumeration request has been processed, before the response is returned.
Fire before registry key metadata retrieval operations.
The BeforeQueryKey event will fire anytime the OS attempts to retrieve a registry key's metadata.
Fire after registry key metadata retrieval operations.
The AfterQueryKey event will fire after a registry key metadata retrieval request has been processed, before the response is returned.
Fire before registry key metadata update operations.
The BeforeSetKey event will fire anytime the OS attempts to update a registry key's metadata.
Fire after registry key metadata update operations.
The AfterSetKey event will fire after a registry key metadata update request has been processed, before the response is returned.
Fire before registry value delete operations.
The BeforeDeleteValue event will fire anytime the OS attempts to delete a registry value.
Fire after registry value delete operations.
The AfterDeleteValue event will fire after a registry value delete request has been processed, before the response is returned.
Fire before value enumeration operations.
The BeforeEnumerateValue event will fire anytime the OS attempts to enumerate a registry key's values.
Fire after value enumeration operations.
The AfterEnumerateValue event will fire after a value enumeration request has been processed, before the response is returned.
Fire before registry value query operations.
The BeforeQueryValue event will fire anytime the OS attempts to query a registry value.
Fire after registry value query operations.
The AfterQueryValue event will fire after a registry value query request has been processed, before the response is returned.
Fire before registry value set/update operations.
The BeforeSetValue event will fire anytime the OS attempts to set or update a registry value.
Fire after registry value set/update operations.
The AfterSetValue event will fire after a registry value set or update request has been processed, before the response is returned.
Fire before get registry key security operations.
The BeforeGetKeySecurity event will fire before the OS queries the security attributes of a registry key.
Fire after registry value query operations.
The AfterGetKeySecurity event will fire after a get security operation has been processed, before the response is returned.
Fire before registry value set/update operations.
The BeforeSetValue event will fire anytime the OS needs to change the security attributes of a registry key.
Fire after registry value set/update operations.
The AfterSetValue event will fire after a security attributes change request has been processed, before the response is returned.
Fire for all registry operations.
Control Events will fire for all registry operations.
A registry key's last write time.
A registry key's name.
A registry key's longest subkey name.
A registry key's class name.
A registry key's longest subkey class name.
The number of subkeys a registry key has.
The number of values a registry key has.
A registry key's longest value name.
A registry key's largest value data size.
A registry key's virtualization information.
A registry value's type.
A registry value's name.
A registry value's data.
A unicode string.
A unicode string that contains environmental variable references.
Binary data.
A 32-bit number.
Multiple unicode strings.
A 64-bit number.
Uninstall drivers from previous class versions (e.g., 2017).
Keep the driver's current start type setting in the registry.
If this flag is not set (default), the installation logic will reset the driver's start type setting in the Windows registry to the default value.
Setting this flag causes the installation logic to preserve the current value, which may be necessary if the user (or the application) set it previously.
Install the driver file when its version and build number is the same as the version of the already installed driver.
Whether internal requests to the filesystem are sent directly to the filesystem driver or through the stack of filesystem filter drivers.
This flag is applicable only for CBFilter and CBMonitor.
Whether the driver should keep track of information for files that are already open when (i.e., were opened before) the class is initialized.
This flag is applicable only for CBFilter and CBMonitor.
Whether the driver should require the controller process to have elevated or system privileges.
This flag is not applicable for CBProcess.
Whether the driver should prevent the controller process from filtering files that it would not normally have access to.
This flag is not applicable for CBProcess.
Uninstall modules from previous product versions.
Uninstall modules from the current product version.
Uninstall modules from all product versions.
The specified module is not present on the system.
The specified module is in the Stopped state.
The specified module is loaded and running.
The file is read-only.
Applications can read the file, but cannot write to it or delete it. This attribute is not honored on directories.
The file or directory is hidden.
The file is not included in an ordinary directory listing.
A file or directory that the operating system uses a part of, or uses exclusively.
The entry is a directory.
The entry is an archive file or directory.
Applications typically use this attribute to mark files for backup or removal.
A file doesn't have other attributes set.
This attribute is valid only when used alone.
A file that is being used for temporary storage.
File systems avoid writing data back to mass storage if sufficient cache memory is available, because typically, an application deletes a temporary file after the handle is closed. In that scenario, the system can entirely avoid writing the data. Otherwise, the data are written after the handle is closed.
A file that is a sparse file.
A file that is a reparse point or a symbolic link.
A file or directory that is compressed.
For a file, all of the data in the file are compressed. For a directory, compression is the default for newly created files and subdirectories. A filesystem implementation can make use of this attribute by setting the SupportCompressedAttribute property to true and then properly handling the GetFileInfo, EnumerateDirectory, and SetFileAttributes events.
The data of a file are not available immediately.
This attribute indicates that the file data are physically moved to offline storage.
The file or directory is not to be indexed by the content indexing service.
A file or directory that is encrypted.
For a file, all data streams in the file are encrypted. For a directory, encryption is the default for newly created files and subdirectories.
Reserved.
The file or directory has no physical representation on the local system; the item is virtual.
Opening the item will be more expensive than normal (e.g., it will cause at least some of it to be fetched from a remote store). This flag is reported by filesystems during directory enumerations.
For a directory, the right to list the contents of the directory.
For a file object, the right to read the corresponding file data.
For a directory object, the right to read the corresponding directory data.
For a directory, the right to create a file in the directory.
For a file object, the right to write data to the file.
For a directory object, the right to create a file in the directory
For a directory, the right to create a subdirectory.
For a file object, the right to append data to the file.
(For local files, write operations will not overwrite existing data if this flag is specified without FILE_WRITE_DATA.) For a directory object, the right to create a subdirectory (FILE_ADD_SUBDIRECTORY).
The right to read extended file attributes.
The right to write extended file attributes.
For a native code file, the right to execute the file.
This access right given to scripts may cause the script to be executable, depending on the script interpreter.
For a directory, the right to delete a directory and all the files it contains, including read-only files.
The right to read file attributes.
The right to write file attributes.
The right to read the information in the file or directory object's security descriptor.
This does not include the information in the SACL.
Includes READ_CONTROL, which is the right to read the information in the file or directory object's security descriptor.
This does not include the information in the SACL.
Same as STANDARD_RIGHTS_READ
Same as STANDARD_RIGHTS_READ
The right to use the object for synchronization.
This enables a thread to wait until the object is in the signaled state. Some object types do not support this access right.
All possible access rights for a file.
A combinarion of flags that allow reading of the file.
Note: Don't match received values against this flag. Instead, use flags that specify the rights that you want to verify or add/remove.
A combinarion of flags that allow modifications to the file.
Note: Don't match received values against this flag. Instead, use flags that specify the rights that you want to verify or add/remove.
A combinarion of flags that allow execution of the file.
Note: Don't match received values against this flag. Instead, use flags that specify the rights that you want to verify or add/remove.
Creates a new file, only if it does not already exist.
If the specified file exists, the operation fails with an "already exists" error.
Creates a new file, always.
If the specified file exists and is writable, the system overwrites the file. If the specified file does not exist and is a valid path, a new file is created.
Opens a file, only if it exists
If the specified file does not exist, opening fails.
Opens a file, always.
If the specified file exists, the operation succeeds. If the specified file does not exist and is a valid path to a writable location, the a file is created.
Opens a file and truncates it so that its size is zero bytes, only if it exists.
If the specified file does not exist, the operation fails with a "file not found" error.
Prevents any process from opening a file or device if it requests delete, read, or write access.
Enables subsequent open operations on a file or device to request read access.
Enables subsequent open operations to request read access; otherwise, no process can open the file or device if it requests read access. If this flag is not specified, but the file or device has been opened for read access, the function fails.
Enables subsequent open operations on a file or device to request write access.
Enables subsequent open operations to request write access; otherwise, no process can open the file or device if it requests write access.
If this flag is not specified, but the file or device has been opened for write access or has a file mapping with write access, the function fails.
Enables subsequent open operations on a file or device to request delete access.
Enables subsequent open operations to request delete access; otherwise, no process can open the file or device if it requests delete access. If this flag is not specified, but the file or device has been opened for delete access, the function fails.
Specifies that the driver should pass IO_IGNORE_SHARE_ACCESS_CHECK flag to the system functions.
Use this flag to bypass sharing checks performed by the I/O manager when opening local files.
An existing file was superseded by the new file.
The previous version of a file may still exist if it had hard links other than the name used in the operation.
The file existed before the operation and was opened.
The file didn't exist before the operation and was created.
The file exists, and its contents have been replaced.
The file existed before the operation, and no action was taken.
The file did not exist before the operation, and no action was taken.
Requests that BypassIO be enabled for the given file, which means an application might not see all non-cached reads for that file.
Informs that BypassIO is being disabled on the specified file.
Queries whether BypassIO can be enabled for the given file.
Requests that BypassIO be paused on the specified volume/storage stack.
Requests that BypassIO processing be resumed on the given volume.
Requests that BypassIO processing be paused on a stream.
Requests that BypassIO processing be resumed on a stream.
Requests information about the BypassIO state of the volume.
Access Restriction Flags
ACCESS_NONE
Value: 0x00
ACCESS_READ_ONLY
Value: 0x01
ACCESS_WRITE_ONLY
Value: 0x02
ACCESS_DELETE_PROTECT
Value: 0x04
ACCESS_EXECUTE_PROTECT
Value: 0x08
ACCESS_NO_CHANGE_DAC
Value: 0x10
ACCESS_NO_CHANGE_OWNER
Value: 0x20
ACCESS_RENAME_PROTECT
Value: 0x40
ACCESS_DELETE_ONLY_PROTECT
Value: 0x80
ACCESS_REMOTE_ACCESS_PROTECT
Value: 0x100
ACCESS_DENY_ALL
Value: 0x200
ACCESS_ALL_FLAGS
Value: -1
Filesystem Control Event Flags
FS_CE_NONE
Value: 0
FS_CE_BEFORE_CREATE
Value: 0x000000000001L
FS_CE_AFTER_CREATE
Value: 0x000000000002L
FS_CE_BEFORE_OPEN
Value: 0x000000000004L
FS_CE_AFTER_OPEN
Value: 0x000000000008L
FS_CE_BEFORE_READ
Value: 0x000000000010L
FS_CE_AFTER_READ
Value: 0x000000000020L
FS_CE_BEFORE_WRITE
Value: 0x000000000040L
FS_CE_AFTER_WRITE
Value: 0x000000000080L
FS_CE_BEFORE_LOCK_CONTROL
Value: 0x000000000100L
FS_CE_AFTER_LOCK_CONTROL
Value: 0x000000000200L
FS_CE_BEFORE_CLEANUP
Value: 0x000000000400L
FS_CE_AFTER_CLEANUP
Value: 0x000000000800L
FS_CE_BEFORE_CLOSE
Value: 0x000000001000L
FS_CE_AFTER_CLOSE
Value: 0x000000002000L
FS_CE_BEFORE_CAN_DELETE
Value: 0x000000004000L
FS_CE_AFTER_CAN_DELETE
Value: 0x000000008000L
FS_CE_BEFORE_DELETE
Value: 0x000000010000L
FS_CE_AFTER_DELETE
Value: 0x000000020000L
FS_CE_BEFORE_RENAME
Value: 0x000000040000L
FS_CE_AFTER_RENAME
Value: 0x000000080000L
FS_CE_BEFORE_GET_SECURITY
Value: 0x000000100000L
FS_CE_AFTER_GET_SECURITY
Value: 0x000000200000L
FS_CE_BEFORE_ENUMERATE_DIRECTORY
Value: 0x000000400000L
FS_CE_AFTER_ENUMERATE_DIRECTORY
Value: 0x000000800000L
FS_CE_BEFORE_QUERY_FILE_INFO
Value: 0x000001000000L
FS_CE_AFTER_QUERY_FILE_INFO
Value: 0x000002000000L
FS_CE_AFTER_GET_SIZES
Value: 0x000008000000L
FS_CE_BEFORE_SET_SECURITY
Value: 0x000010000000L
FS_CE_AFTER_SET_SECURITY
Value: 0x000020000000L
FS_CE_BEFORE_SET_ATTRIBUTES
Value: 0x000040000000L
FS_CE_AFTER_SET_ATTRIBUTES
Value: 0x000080000000L
FS_CE_BEFORE_SET_SIZES
Value: 0x000100000000L
FS_CE_AFTER_SET_SIZES
Value: 0x000200000000L
FS_CE_BEFORE_CREATE_HARD_LINK
Value: 0x000400000000L
FS_CE_AFTER_CREATE_HARD_LINK
Value: 0x000800000000L
FS_CE_BEFORE_FSCTL
Value: 0x001000000000L
FS_CE_AFTER_FSCTL
Value: 0x002000000000L
FS_CE_BEFORE_IOCTL
Value: 0x004000000000L
FS_CE_AFTER_IOCTL
Value: 0x008000000000L
FS_CE_BEFORE_SET_FILE_INFO
Value: 0x010000000000L
FS_CE_AFTER_SET_FILE_INFO
Value: 0x020000000000L
FS_CE_BEFORE_SET_EA
Value: 0x040000000000L
FS_CE_AFTER_SET_EA
Value: 0x080000000000L
FS_CE_BEFORE_QUERY_EA
Value: 0x100000000000L
FS_CE_AFTER_QUERY_EA
Value: 0x200000000000L
FS_CE_BEFORE_GET_REPARSE_POINT
Value: 0x400000000000L
FS_CE_AFTER_GET_REPARSE_POINT
Value: 0x800000000000L
FS_CE_BEFORE_SET_REPARSE_POINT
Value: 0x1000000000000L
FS_CE_AFTER_SET_REPARSE_POINT
Value: 0x2000000000000L
FS_CE_BEFORE_DELETE_REPARSE_POINT
Value: 0x4000000000000L
FS_CE_AFTER_DELETE_REPARSE_POINT
Value: 0x8000000000000L
FS_CE_REPARSE_FILENAME
Value: 0x40000000000000L
FS_CE_REPARSE_TAG
Value: 0x80000000000000L
FS_CE_ALL
Value: -1
Filesystem Notification Event Flags
FS_NE_NONE
Value: 0
FS_NE_CREATE
Value: 0x00000001L
FS_NE_OPEN
Value: 0x00000002L
FS_NE_READ
Value: 0x00000004L
FS_NE_WRITE
Value: 0x00000008L
FS_NE_LOCK_CONTROL
Value: 0x00000010L
FS_NE_CLEANUP
Value: 0x00000020L
FS_NE_CLOSE
Value: 0x00000040L
FS_NE_CAN_DELETE
Value: 0x00000080L
FS_NE_DELETE
Value: 0x00000100L
FS_NE_RENAME
Value: 0x00000200L
FS_NE_GET_SECURITY
Value: 0x00000400L
FS_NE_ENUMERATE_DIRECTORY
Value: 0x00000800L
FS_NE_QUERY_FILE_INFO
Value: 0x00001000L
FS_NE_GET_SIZES
Value: 0x00002000L
FS_NE_SET_SECURITY
Value: 0x00004000L
FS_NE_SET_ATTRIBUTES
Value: 0x00008000L
FS_NE_SET_SIZES
Value: 0x00010000L
FS_NE_CREATE_HARD_LINK
Value: 0x00020000L
FS_NE_FSCTL
Value: 0x00040000L
FS_NE_IOCTL
Value: 0x00080000L
FS_NE_SET_FILE_INFO
Value: 0x00100000L
FS_NE_SET_EA
Value: 0x00200000L
FS_NE_QUERY_EA
Value: 0x00400000L
FS_NE_GET_REPARSE_POINT
Value: 0x00800000L
FS_NE_SET_REPARSE_POINT
Value: 0x01000000L
FS_NE_DELETE_REPARSE_POINT
Value: 0x02000000L
FS_BYPASS_IO
Value: 0x40000000L
FS_NE_ALL
Value: -1
Directory Enumeration flags
FS_ENUM_RESTART_SCAN
Value: 1
FS_ENUM_RETURN_SINGLE_ENTRY
Value: 2
FS_ENUM_INDEX_SPECIFIED
Value: 4
Filesystem Reparse Flags
FS_REPARSE_CHANGE_PATH
Value: 0
FS_REPARSE_USE_REPARSE_POINT
Value: 1
Filesystem Request Directions
FS_REQUEST_DIR_USER_NONCACHED
Value: 0
FS_REQUEST_DIR_USER_CACHED
Value: 1
FS_REQUEST_DIR_SYSTEM_NONCACHED
Value: 2
FS_REQUEST_DIR_SYSTEM_CACHED
Value: 3
Filesystem Volume Mount Events
FS_MOUNT_IGNORE
Value: 0
FS_MOUNT_NOTIFY
Value: 64
FS_MOUNT_CONTROL
Value: 128
FS_MOUNT_BOTH
Value: 192
File Flushing Behavior Flags
FS_FLUSH_FILES_ON_OPEN
Value: 1
Applications that modify file data as it is being read may need to set this flag to function correctly. For example, applications that provide on-the-fly encryption should set this flag to ensure that file data are always read from the disk (and thus have a chance to get decrypted) when a file is opened.
Applications that do not modify file data as it is being read should leave this flag unset to maintain optimal performance when opening files.
FS_FLUSH_FILES_ON_CLOSE
Value: 2
Applications that modify file data as it is being written may need to set this flag to function correctly. For example, applications that provide on-the-fly encryption should set this flag to ensure that all file data are flushed to the disk (and thus has a chance to get encrypted) when a file is closed.
Applications that do not modify file data as it is being written can unset this flag.
After a file is flushed, all in-memory buffers and memory mappings are cleared to avoid leakage of unprotected information.
FS_CLOSE_FILES_ON_STOPFILTER
Value: 4
Applications that modify file data as it is being written (e.g., on-the-fly encryption) may need to set this flag to prevent further operations against the file data from being performed. Applications that do not modify file data as it is being written can leave this flag unset.
Note: If memory mappings of some file exist, these mappings will remain active; only the open handles to such files are closed.
When the file is closed, all in-memory buffers and memory mappings are cleared to avoid leakage of unprotected information. Applications can control whether file data are flushed before files are closed using the FS_FLUSH_FILES_ON_STOPFILTER flag; any data that are not flushed get discarded.
FS_FLUSH_FILES_ON_STOPFILTER
Value: 8
Applications that modify file data as it is being written (e.g., on-the-fly encryption) may need to set this flag to ensure that no unprotected data are kept in memory, but rather has a chance to be encrypted and written out to disk. Applications that do not modify file data as it is being written can leave this flag unset.
If the application will not be able to perform on-the-fly data modification at the moment when StopFilter is called (e.g., because a cryptographic hardware module is unplugged), then this flag should be unset before calling StopFilter.
After a file is flushed, all in-memory buffers and memory mappings are cleared to avoid leakage of unprotected information.
FS_CLOSE_FILES_ON_CRASH
Value: 16
Applications that modify file data as it is being written (e.g., on-the-fly encryption) may need to set this flag to prevent further operations against the file data from being performed. Applications that do not modify file data as it is being written can leave this flag unset.
Note: If memory mappings of some file exist, these mappings will remain active; only the open handles to such files are closed.
When the file is closed, all in-memory buffers and memory mappings are cleared to avoid leakage of unprotected information.
FS_FLUSH_FILES_ON_CRASH
Value: 32
Applications that do not modify data as it is being written may set this flag if necessary. Applications that modify data as it is being written (e.g., on-the-fly encryption) should not set this flag, because such flushing could cause unprotected data to be written out to disk.
FS_SUPPORT_FILE_ENCRYPTION
Value: 31
Delete request types
DEL_REQ_OPEN_FLAG
Value: 0x1
DEL_REQ_SET_DISPOSITION
Value: 0x2
Process Event Flags
PROC_EVT_NONE
Value: 0
PROC_EVT_PROCESS_CREATION
Value: 1
PROC_EVT_PROCESS_TERMINATION
Value: 2
PROC_EVT_PROCESS_HANDLE_OPERATION
Value: 4
PROC_EVT_THREAD_CREATION
Value: 8
PROC_EVT_THREAD_TERMINATION
Value: 0x10
PROC_EVT_THREAD_HANDLE_OPERATION
Value: 0x20
PROC_EVT_ALL
Value: -1
Registry Control Event Flags
REG_CE_NONE
Value: 0
REG_CE_BEFORE_CREATE_KEY
Value: 0x00000001L
REG_CE_AFTER_CREATE_KEY
Value: 0x00000002L
REG_CE_BEFORE_OPEN_KEY
Value: 0x00000004L
REG_CE_AFTER_OPEN_KEY
Value: 0x00000008L
REG_CE_BEFORE_CLOSE_KEY
Value: 0x00000010L
REG_CE_AFTER_CLOSE_KEY
Value: 0x00000020L
REG_CE_BEFORE_DELETE_KEY
Value: 0x00000040L
REG_CE_AFTER_DELETE_KEY
Value: 0x00000080L
REG_CE_BEFORE_RENAME_KEY
Value: 0x00000100L
REG_CE_AFTER_RENAME_KEY
Value: 0x00000200L
REG_CE_BEFORE_ENUM_KEY
Value: 0x00000400L
REG_CE_AFTER_ENUM_KEY
Value: 0x00000800L
REG_CE_BEFORE_QUERY_KEY
Value: 0x00001000L
REG_CE_AFTER_QUERY_KEY
Value: 0x00002000L
REG_CE_BEFORE_SET_KEY
Value: 0x00004000L
REG_CE_AFTER_SET_KEY
Value: 0x00008000L
REG_CE_BEFORE_DELETE_VALUE
Value: 0x00010000L
REG_CE_AFTER_DELETE_VALUE
Value: 0x00020000L
REG_CE_BEFORE_ENUM_VALUE
Value: 0x00040000L
REG_CE_AFTER_ENUM_VALUE
Value: 0x00080000L
REG_CE_BEFORE_QUERY_VALUE
Value: 0x00100000L
REG_CE_AFTER_QUERY_VALUE
Value: 0x00200000L
REG_CE_BEFORE_SET_VALUE
Value: 0x00400000L
REG_CE_AFTER_SET_VALUE
Value: 0x00800000L
REG_CE_BEFORE_GET_KEY_SECURITY
Value: 0x001000000L
REG_CE_AFTER_GET_KEY_SECURITY
Value: 0x002000000L
REG_CE_BEFORE_SET_KEY_SECURITY
Value: 0x004000000L
REG_CE_AFTER_SET_KEY_SECURITY
Value: 0x008000000L
REG_CE_ALL
Value: -1
Registry Key Fields
REG_KEYFIELD_LASTWRITETIME
Value: 1
REG_KEYFIELD_NAME
Value: 2
REG_KEYFIELD_MAXNAMELENGTH
Value: 4
REG_KEYFIELD_CLASSNAME
Value: 8
REG_KEYFIELD_MAXCLASSNAMELENGTH
Value: 16
REG_KEYFIELD_SUBKEYS
Value: 32
REG_KEYFIELD_VALUES
Value: 64
REG_KEYFIELD_MAXVALUENAMELENGTH
Value: 128
REG_KEYFIELD_MAXVALUEDATASIZE
Value: 256
REG_KEYFIELD_VIRTUALIZATIONINFO
Value: 512
Registry Value Fields
REG_VALUEFIELD_TYPE
Value: 1
REG_VALUEFIELD_NAME
Value: 2
REG_VALUEFIELD_DATA
Value: 4
Registry Value Types
REG_VALUETYPE_SZ
Value: 1
REG_VALUETYPE_EXPAND_SZ
Value: 2
REG_VALUETYPE_BINARY
Value: 3
REG_VALUETYPE_DWORD
Value: 4
REG_VALUETYPE_MULTI_SZ
Value: 7
REG_VALUETYPE_QWORD
Value: 11
Install Flags
INSTALL_REMOVE_OLD_VERSIONS
Value: 0x00000001
INSTALL_KEEP_START_TYPE
Value: 0x00000002
INSTALL_OVERWRITE_SAME_VERSION
Value: 0x00000004
INSTALL_REQUESTS_VIA_DRIVER_STACK
Value: 0x00001000
After installation, the effects of this flag can be changed using the SendRequestsViaDriverStack configuration setting.
INSTALL_ALWAYS_PREPARE_FILES
Value: 0x00010000
If this flag is set, the driver will prepare information about each file as it is opened, regardless of whether a CBFilter/CBMonitor-based application is actually running at the time. This information then allows applications to receive events for any files that are already open when the CBFilter/CBMonitor class is initialized.
Note: These preparations will slow down all file open operations; do not enable this feature unless it is actually necessary.
After installation, the effects of this flag can be changed using the AlwaysPrepareFiles configuration setting.
INSTALL_FORCE_APP_PERMISSION_CHECK
Value: 0x00020000
If this flag is set, the driver will verify that the controller process is a system service (or is executing with elevated privileges) anytime a file is opened. If the controller process does not meet these requirements, the file will be skipped (i.e., not filtered in any way).
Note: This additional verification will slow down all file open operations.
After installation, the effects of this flag can be changed using the ForceAppPermissionCheck configuration setting.
INSTALL_FORCE_SECURITY_CHECKS
Value: 0x00040000
If this flag is set, the driver will check the security permissions of the controller process anytime a file is opened to verify that the process has access to the file. If the controller process does not have access to the file, the file will be skipped (i.e., not filtered in any way). For example, if this flag is set and the controller process is running with limited privileges, then the driver will not allow it to filter files that require greater privileges to access.
Note: This additional verification will slow down all file open operations.
After installation, the effects of this flag can be changed using the ForceSecurityChecks configuration setting.
Uninstall Version Flags
UNINSTALL_VERSION_PREVIOUS
Value: 0x00000001
Note: This functionality is only available in Windows.
UNINSTALL_VERSION_CURRENT
Value: 0x00000002
Note: This functionality is only available in Windows.
UNINSTALL_VERSION_ALL
Value: 0x00000003
Note: This functionality is only available in Windows.
Module Status Flags
MODULE_STATUS_NOT_PRESENT
Value: 0x00000000
Note: This functionality is only available in Windows.
MODULE_STATUS_STOPPED
Value: 0x00000001
Note: This functionality is only available in Windows.
MODULE_STATUS_RUNNING
Value: 0x00000004
Note: This functionality is only available in Windows.
File Attributes
FILE_SYS_ATTR_READ_ONLY
Value: 0x00000001
FILE_SYS_ATTR_HIDDEN
Value: 0x00000002
FILE_SYS_ATTR_SYSTEM
Value: 0x00000004
FILE_SYS_ATTR_DIRECTORY
Value: 0x00000010
FILE_SYS_ATTR_ARCHIVE
Value: 0x00000020
FILE_SYS_ATTR_NORMAL
Value: 0x00000080
FILE_SYS_ATTR_TEMPORARY
Value: 0x00000100
FILE_SYS_ATTR_SPARSE_FILE
Value: 0x00000200
FILE_SYS_ATTR_REPARSE_POINT
Value: 0x00000400
FILE_SYS_ATTR_COMPRESSED
Value: 0x00000800
FILE_SYS_ATTR_OFFLINE
Value: 0x00001000
FILE_SYS_ATTR_NOT_CONTENT_INDEXED
Value: 0x00002000
FILE_SYS_ATTR_ENCRYPTED
Value: 0x00004000
Note: This flag is used by NTFS and the OS sends undocumented requests to the filesystem based on this flag. The flag should not be used for files in custom filesystem implementations.
FILE_SYS_ATTR_VIRTUAL
Value: 0x00010000
Note: This flag is reserved by the OS and should not be used for files in custom filesystem implementations.
FILE_SYS_ATTR_RECALL_ON_OPEN
Value: 0x00040000
File Desired Access Flags
DESIRED_ACCESS_FILE_LIST_DIRECTORY
Value: 0x00000001
DESIRED_ACCESS_FILE_READ_DATA
Value: 0x00000001
DESIRED_ACCESS_FILE_ADD_FILE
Value: 0x00000002
DESIRED_ACCESS_FILE_WRITE_DATA
Value: 0x00000002
DESIRED_ACCESS_FILE_ADD_SUBDIRECTORY
Value: 0x00000004
DESIRED_ACCESS_FILE_APPEND_DATA
Value: 0x00000004
DESIRED_ACCESS_FILE_READ_EA
Value: 0x00000008
DESIRED_ACCESS_FILE_WRITE_EA
Value: 0x00000010
DESIRED_ACCESS_FILE_EXECUTE
Value: 0x00000020
DESIRED_ACCESS_FILE_DELETE_CHILD
Value: 0x00000040
DESIRED_ACCESS_FILE_READ_ATTRIBUTES
Value: 0x00000080
DESIRED_ACCESS_FILE_WRITE_ATTRIBUTES
Value: 0x00000100
DESIRED_ACCESS_READ_CONTROL
Value: 0x00020000
DESIRED_ACCESS_STANDARD_RIGHTS_READ
Value: 0x00020000
DESIRED_ACCESS_STANDARD_RIGHTS_WRITE
Value: 0x00020000
DESIRED_ACCESS_STANDARD_RIGHTS_EXECUTE
Value: 0x00020000
DESIRED_ACCESS_SYNCHRONIZE
Value: 0x00100000
DESIRED_ACCESS_FILE_ALL_ACCESS
Value: 0x001F01FF
DESIRED_ACCESS_FILE_GENERIC_READ
Value: 0x00120089
DESIRED_ACCESS_FILE_GENERIC_WRITE
Value: 0x00120116
DESIRED_ACCESS_FILE_GENERIC_EXECUTE
Value: 0x001200A0
Creation Disposition flags
FILE_DISPOSITION_CREATE_NEW
Value: 0x00000001
FILE_DISPOSITION_CREATE_ALWAYS
Value: 0x00000002
FILE_DISPOSITION_OPEN_EXISTING
Value: 0x00000003
FILE_DISPOSITION_OPEN_ALWAYS
Value: 0x00000004
FILE_DISPOSITION_TRUNCATE_EXISTING
Value: 0x00000005
Share Mode Flags
FILESYS_SHARE_NONE
Value: 0x00000000
FILESYS_SHARE_READ
Value: 0x00000001
FILESYS_SHARE_WRITE
Value: 0x00000002
FILESYS_SHARE_DELETE
Value: 0x00000004
Note: Delete access allows both delete and rename operations.
CBFILTER_IGNORE_SHARE_ACCESS_CHECK
Value: 0x10000000
Note: The filesystem still may perform these checks. Also, the internal structures are not updated with the share mode values, passed in this call. This means that subsequent file open operations will not know about the previous share mode and may succeed where they would have to fail.
Creation Status values
CREATION_STATUS_SUPERSEDED
Value: 0x00000000
CREATION_STATUS_OPENED
Value: 0x00000001
CREATION_STATUS_CREATED
Value: 0x00000002
CREATION_STATUS_OVERWRITTEN
Value: 0x00000003
CREATION_STATUS_EXISTS
Value: 0x00000004
CREATION_STATUS_DOES_NOT_EXIST
Value: 0x000000055
BypassIO operations
BPIO_OP_ENABLE
Value: 1
BPIO_OP_DISABLE
Value: 2
BPIO_OP_QUERY
Value: 3
BPIO_OP_VOLUME_STACK_PAUSE
Value: 4
BPIO_OP_VOLUME_STACK_RESUME
Value: 5
BPIO_OP_STREAM_PAUSE
Value: 6
BPIO_OP_STREAM_RESUME
Value: 7
BPIO_OP_GET_INFO
Value: 8