What are the primary differences between filtering rdr and filtering a local file system?
In general, filtering a local file system differs somewhat from filtering a redirector in a number of key areas: (a) File state tracking. Network file systems frequently defer operations in order to minimize the network traffic. For example, CIFS defers opening files until necessary. This can lead to changing the “FsContext” value of the file object, for instance, which complicates the tracking for file system filter drivers. (c) Security. Network file systems routinely restrict operations that can be performed by the system process using standard system credentials. Thus file system filter drivers may need to utilize advanced techniques, such as impersonation, etc. in order to circumvent these security considerations. (d) Private APIs between user mode service and kernel mode driver. Some of the processing needed by the network redirector is implemented in a user mode service. The user mode service and kernel mode driver interact using a private IOCTL-based API. (e) Support for UNC na
