title: Distinction between copy paste and file read on MiniFilter
body: <p>I'm planning to make a MiniFilter do make some file encryption, add some meta-data on files.</p>
  
  <p>I think I understand what I need to do, in my MiniFilter, to make that files are stored in their encrypted form but can be read by the system with no problems.</p>
  
  <p>If an application ask a read on the file, I need to query the encrypted part, dechiper and send it back to the system.</p>
  
  <p>If I try to copy the file, I need to copy the whole file, with meta-data and encrypted payload.</p>
  
  <p>But I think I may have a problem with meta-data : as I cannot find a way to know if the IRP_MJ_READ i got is from an app trying to read the file or a copy-paste request, I will never be able to read the meta-data and either copy them.</p>
  
  <p>Is there some informations, in the IRP_MJ_READ or the IRP_MJ_CREATE, that is specific from a copy paste action ?</p>