FltRegisterForDataScan function (fltkernel.h)

Article
02/22/2024

The FltRegisterForDataScan routine enables data scanning for the volume attached to the minifilter instance.

Syntax

NTSTATUS FLTAPI FltRegisterForDataScan(
  [in] PFLT_INSTANCE Instance
);

Parameters

[in] Instance

An opaque instance pointer for the minifilter driver instance to register for data scanning.

Return value

FltRegisterForDataScan returns STATUS_SUCCESS or an appropriate NTSTATUS value, such as one of the following.

Return code	Description
STATUS_NOT_SUPPORTED	The filter manager does not support data scans for the volume attached to this instance.

Remarks

A minifilter that does data scanning must register its volume for scanning by calling FltRegisterForDataScan prior to calling FltCreateSectionForDataScan. Minifilters do data scans for various reasons, such as virus detection, encryption, or compression.

Note

If FltRegisterForDataScan returns STATUS_NOT_SUPPORTED, a minifilter can still create sections for data scanning by calling FsRtlCreateSectionForDataScan. However, access to the section created by FsRtlCreateSectionForDataScan is not synchronized, and it is the calling minifilter's responsibility to handle any conflict resolution that arises. Such a minifilter must implement and register a PFLT_SECTION_CONFLICT_NOTIFICATION_CALLBACK callback routine that can be called when section conflict occurs.

Requirements

Requirement	Value
Minimum supported client	Windows 8
Target Platform	Universal
Header	fltkernel.h (include Fltkernel.h)
Library	FltMgr.lib
DLL	Fltmgr.sys
IRQL	<= APC_LEVEL