Have you ever double-clicked a document and wondered what exactly happens behind the scenes? To the user, opening or creating a file takes a fraction of a second. But deep within the Windows operating system, a complex and highly orchestrated sequence of events takes place.

If you are a developer looking to monitor, secure, or alter how files are accessed in Windows, understanding this sequence is crucial. Today, we are going to dive into the Windows file open and creation process, and explore how the EaseFilter File Monitor SDK and File Control SDK simplify intercepting, monitoring, and controlling these operations using C#.

The Journey of a File Request: From User to Kernel

When an application (like Notepad or Word) wants to open or create a file, it does not talk directly to your hard drive. Instead, it makes a polite request to the Windows API, typically by calling a function named CreateFile.

This request crosses the boundary from User Mode (where applications live) into Kernel Mode (the core of the operating system), specifically landing on the desk of the I/O Manager.

Here is the step-by-step breakdown of that process:

1. The Request: The application calls the file creation API.
2. The I/O Manager: The Windows I/O Manager receives this request and packages it into a standard data structure called an I/O Request Packet (IRP). For opening or creating a file, this specific packet is labeled IRP_MJ_CREATE.
3. The Filter Manager: Before the IRP reaches the actual file system (like NTFS or FAT32), it passes through the Filter Manager. This is a framework provided by Microsoft that allows third-party drivers (called "Minifilters") to inspect or modify the IRP.
4. The File System: If no filter driver blocks the request, it reaches the file system driver, which translates the request into physical storage commands.
5. The Return Trip: Once the file is opened or created, a success (or failure) status travels all the way back up the stack to the application.

Enter the Minifilter

Traditionally, writing a driver to intercept IRP_MJ_CREATE was a notoriously difficult and error-prone task. A single bug in kernel mode results in the dreaded Blue Screen of Death (BSOD).

Microsoft introduced the Filter Manager and "Minifilters" to make this safer. However, writing kernel-level C/C++ code still requires highly specialized knowledge. This is where the EaseFilter File Control SDK comes to the rescue. It provides a pre-tested, robust Minifilter driver and exposes a simple User-Mode API (in C#, C++, etc.) to handle the events securely.

How EaseFilter SDK Handles File Open and Creation

When you use the EaseFilter File Monitor SDK to monitor file opens and creations, it handles the IRP_MJ_CREATE request using a powerful two-step callback system, visualized in the architecture diagram above:

1. The Pre-Create Callback (Control)

When the I/O Manager sends the IRP_MJ_CREATE packet down the stack, the EaseFilter kernel driver intercepts it before it reaches the NTFS file system (the 'Intercept Point' in the diagram). It immediately alerts your user-mode application via the OnPreFileCreate event.

At this stage, you have complete control. Your application can evaluate who is opening the file, what the file is, and what they intend to do. You can:

• Allow the request: Let the IRP continue down to the file system.
• Block the request: Return an "Access Denied" status to stop ransomware or unauthorized users.
• Modify the request: Redirect the file to a different location or change access rights.

2. The Post-Create Callback (Notification)

If you allowed the request to pass through during the Pre-Create phase, the file system attempts to open or create the file. On the way back up the stack, EaseFilter intercepts the result and triggers the OnPostFileCreate event.

At this stage, you get a notification of the outcome. This is incredibly useful for:

• Auditing and Logging: Recording exactly when a file was successfully created, and by which process.
• Event Triggering: Kicking off a secondary process (like backing up a file or scanning for malware) right after a new file is written to the disk.

Putting it into Practice: C# Code Snippet

Below is a complete C# example using the EaseFilter SDK. It demonstrates how to set up a filter rule for a specific folder, use a callback to control (block) specific processes from creating files, and use another callback to get a notification when a file is successfully created.

Summary

Understanding the lifecycle of IRP_MJ_CREATE is the key to mastering Windows file system behaviors. By abstracting away the dangers and complexities of kernel-mode driver development, the EaseFilter SDK allows developers to easily inject their own C# logic into the file creation process.

Whether you are building a secure auditing tool that logs notifications, an encryption layer, or a Zero Trust access control system that blocks unauthorized activity, intercepting these Pre-Create and Post-Create I/O requests is your foundational building block.