PolAttachVolume callback function

A Policy DLL's PolAttachVolume callback function is called to inform the Policy DLL that a volume has been discovered – for instance as a result of a thumb drive being inserted or a volume being formatted.

Syntax

bool

POL_ATTACH_VOLUME(

    _In_ LPCWSTR DeviceName,

    _Inout_ _Notnull_ GUID *VolumeGUID,

    _In_ DWORD DeviceFlags,

    _In_ DWORD DeviceCharacteristics,

    _In_ DWORD VolumeDeviceType,

    _In_ DWORD VolumeFilesystemType

);

Parameters

DeviceName [in]

The volume’s (kernel) device name – typically of the form “\Device\HarddiskVolume5”.

VolumeGUID [inout]

The volume’s GUID.  This might be one of the defined GUIDS FE_SHADOW_VOLUME_GUID or FE_NO_VOLUME_GUID_AVAILABLE.  The PolicyDLL can choose to overwrite this value with a GUID of its choice and this will be set in the future in the POLICY_PATH structure.

DeviceFlags [in]

The volume’s Device Object flags, copied directly from the DEVICE_OBJECT structure’s Flags field.

DeviceCharacteristics [in]

The volume’s Device Object characteristics, copied directly from the DEVICE_OBJECT structure’s Characteristics field.

VolumeDeviceType [in]

The volume’s Device Object device type, copied directly from the DEVICE_OBJECT structure’s DeviceType field.

VolumeFilesystemType [in]

The volume’s file system type, as described by the FLT_FILESYSTEM_TYPE enumeration.

Return value

If the DLL returns TRUE, then FESF will process files on this volume.

Remarks

The values passed as arguments into this structure are as provided to the FESF kernel-mode filter components by the Windows Filter Manager.  See, for example, the Microsoft document for the PFLT_INSTANCE_SETUP_CALLBACK callback function.

Examples

See Also

Requirements