Take the 2-minute tour ×

The following is quoted from the "Security improvements" section of this article.


However, googling failed to reveal more information such as the name of the API. Perhaps I am googling on the wrong terms... Does anybody has any ideas?

share|improve this question
add comment

2 Answers


System components send this IRP to ask the drivers for a device whether the device can support a special file. Special files include paging files, dump files, and hibernation files. If all the drivers for the device succeed the IRP, the system creates the special file. The system also sends this IRP to inform drivers that a special file has been removed from the device.

Of course, this only matters if you write a Crash Dump Filter Driver like TrueCrypt and handle file system driver operations like IRP_MJ_READ/IRP_MJ_WRITE and encrypt the file data somehow.

share|improve this answer
add comment

I'm pretty sure MS uses BitLocker to encrypt the system volume including system and hibernation files.


The necessary file to include is called fveapi.dll

share|improve this answer
add comment

Your Answer


