I'm writing a windows filter driver which needs to block all write operations on portable devices, I got the blocking part, but struggle to determine the device type. What I have is an Irp and a DeviceObject for every write operation attempted on the PC. I tried getting bit flags from DeviceObject like this DeviceObject->Characteristics & FILE_REMOVABLE_MEDIA for all the possible flags described on microsoft, but it is always set at FILE_REMOTE_DEVICE and FILE_DEVICE_ALLOW_APPCONTAINER_TRAVERSAL, whether the usb flash drive is installed or not.
What is the correct way to check for it?
Asked
Active
Viewed 40 times
2
-
Is this a duplicate? https://stackoverflow.com/questions/45045670/reliably-know-if-a-volume-is-removable-or-not-with-winapi – nielsen Jun 26 '23 at 09:25
-
I don't think I can use it in a driver. – Sinusoidal Depleneration Jun 26 '23 at 09:29