Starting with version 3 CallbackFilter in legacy mode supports creation and operations with virtual files and directories, i.e. entries which are not present in the actual filesystems. Virtual files don't work in mini-filter mode.
To make of this feature, you need to do the following:
- Set OwnProcessFiltered property to true in order to "catch" file creation requests that your application makes on the next step.
- Somewhere in your code call CreateFile() Windows API function (or the corresponding method in .NET API) to create the virtual file or directory and let Windows know that such file or directory exists. This request should be intercepted and handled in OnCreateFileC and/or OnOpenFileC events. The obtained handle should be stored in some list so that it could be closed when the application is shut down
- Handle OnCreateFileC and OnOpenFileC callbacks / events. In these callback / event handlers, when the request comes to create or open the virtual file, your code should set VirtualFile parameter to true. See the note below regarding consequent file opens.
- Handle other callbacks / events related to file reading, writing and seeking. Provide data and information about file size in the event handlers.
- Handle OnDeleteVirtualFileC callback / event to handle file deletion (if the user decides to "delete" such file).
- When the application is shut down, call DeleteFile() or RemoveDirectory() WinAPI function (or the corresponding method in .NET API). This will let the OS know that the files don't exist anymore.
When the file is opened several times, CallbackFilter knows whether the file is virtual. In this case it passes FILE_ATTRIBUTE_VIRTUAL_FILE (numeric value 0x10000 or 65536 decimal) in FileAttributes parameter of On*Create* or On*Open* callback / event handler. This lets your code know, that the file has been already opened as virtual.