When you need to track file operations that are performed on the remote system (usually a file server), you need to understand specifics and limitations of filesystem filtering technology.
CallbackFilter driver must be installed on the computer that you need to monitor. You can monitor mounted remote disks, but only for operations that originate from the computer where CallbackFilter is installed.
Example: if you have a server S to monitor and you have two clients (C1 and C2), you have the following options:
- install CallbackFilter on S
- install CallbackFilter on C1 and C2 to track operations on disks shared by S when such operations are performed on C1 and C2 accordingly.
If you install the driver only on C1, you will be able to capture operations that are performed on S only by C1 but not by C2.
Modification of requests
Correct modification of Read and Write requests (e.g. for the purpose of encrypting the data) is possible only for local filesystems and doesn't work with network devices (including locally mounted remote shared storage).