Control over registry operations in Windows and .NET applications

OnWriteFileC event/delegate/callback


Pascal    C++ (Lib)    C++ (VCL)    C++ (.NET)    C#    VB.NET   

CallbackRegistry     See also    


This callback is called when the OS needs to write the data from the open file or volume.


    property OnWriteFileC : TCbFltWriteFileEventC;
    TCbFltWriteFileEventC = procedure(Sender : TObject; FileName: TCBString; var Position: Int64; var Buffer; var BytesToWrite: LongWord; Cached: Boolean; var UserContext: pointer; var ProcessRequest: boolean) of object;
    type TCBString = {$ifdef UNICODE}UnicodeString{$else}WideString{$endif};

[C++ (Lib)]
    typedef void (*CbFltWriteFileEventC)(CallbackRegistry* Sender, LPWSTR FileName, __int64 *Position, PVOID Buffer, LPDWORD BytesToWrite, BOOL Cached, PVOID* UserContext, LPBOOL RequestAccepted);

[C++ (VCL)]
    typedef void __fastcall (__closure *TCbFltWriteFileEventC)(System::TObject* Sender, TCBString FileName, __int64 &Position, void *Buffer, unsigned long &BytesToWrite, bool Cached, void * UserContext, bool &ProcessRequest);

[C++ (.NET)]
    public delegate void CbFltWriteFileEventC(CallbackRegistry^ Sender, String^ FileName, Int64% Position, IntPtr Buffer, Int32% BytesToWrite, bool Cached, IntPtr% UserContext, bool% ProcessRequest);

    delegate void CbFltWriteFileEventC(CallbackRegistry^ Sender, string FileName, ref long Position, IntPtr Buffer, ref Int32 BytesToWrite, bool Cached, ref IntPtr UserContext, ref bool ProcessRequest);

    Delegate Sub CbFltWriteFileEventC(ByVal Sender As CallbackRegistry, ByVal FileName As String, ByRef Position As Long, ByVal Buffer As IntPtr, ByRef BytesToWrite As Int32, ByVal Cached As Boolean, ByRef UserContext As IntPtr, ByRef ProcessRequest As Boolean)


  • Sender - reference to the class that called the delegate/event handler
  • FileName - contains the name of the file
  • Position - the starting position to write the file data to
  • Buffer - the buffer to put the write data
  • BytesToWrite - the number of bytes to write from the file. The Buffer contains not more space, than this value.
  • Cached - specifies if the operation is a cached write (see description)
  • UserContext - the placeholder for the application-defined data
  • ProcessRequest (RequestAccepted) - specifies, whether the request must be passed further to the underlying filters and the file system


This callback event is fired when the OS needs to write the data to the open file or volume, before the request is passed to the underlying file system. If you need to alter the data before writing, write the data (no more than BytesToWrite bytes) to the provided buffer. If your application writes the data elsewhere and doesn't write them to the underlying file system, set ProcessRequest parameter to false.

To report the failure and cancel writing operation you need to throw an instance of ECBFltError (setting ProcessRequest to false won't cancel the operation).

In .NET you should not try to replace the Buffer. Instead you need to copy the data to the provided buffer. You can use Array.Copy method for this.

Read more about contexts.

Read more about cached and non-cached requests

Error handling

See Error handling topic for detailed information about how to report errors, which occur in the event handlers, back to CallbackRegistry.

See also


Back to top