On*CreateFile* and On*OpenFile* callbacks
CallbackFilter has three pairs callbacks that notify the application about the file being created or opened. They are OnCreateFileC and OnOpenFileC, OnCreateFileN and OnOpenFileN, OnPostCreateFileC and OnPostOpenFileC.
When the request to the file system is sent, it's not exactly known for the OS and the calling process, whether the file exists. While you can enumerate the directory, the change (file has been created or deleted) might have happened after enumeration and before you call file create or open. So the OS offers only one system call, CreateFile() API function, to both create and open the file.
CreationDisposition parameter of CreateFile() tells the OS and the file system what to do if the file exists or doesn't exist. In one (and just one case) the request is sent to create a file - when the application sets CreationDisposition to CREATE_NEW. With any other value of CreationDisposition parameter the request is sent to open a file and consider the value of CreationDisposition parameter.
Consequently, CallbackFilter doesn't know whether the file is created or opened. It can call one of On*Create* callbacks only when the file is created with CreationDisposition to CREATE_NEW, no matter whether the file exists already. And On*Open* callbacks are called in all other cases. In other words, On*Open* callback can be called even when the file doesn't exist and you'd expect On*Create* to be called.