Hello, eight, you wrote: E> Disk operations filter manager allows to process absolutely fairly, and here storage is not present. If operations are implied by storage with files (MMF), this statement not absolutely truth (see more low). E> the Task, consists in that the data in system cache got in an open type (or generally it not to use). Perhaps, I not absolutely understood the task but why it is simple not input-output, leaving enciphering and decoding only for those operations which work with a disk (i.e. where flags IRP_NOCACHE and-or IRP_PAGING_IO/IRP_SYNCHRONOUS_PAGING_IO are installed)? In this case in a cache always will be plaintext. For example: * comes "normal" (without flags nocache/paging) IRP_MJ_READ/IRP_MJ_WRITE - we pass it downwards as is. * comes IRP_MJ_WRITE with flags nocache or paging - we cipher contents (a-lja SwapBuffers sample). * comes IRP_MJ_READ with flags nocache or paging - we fulfill decoding. * etc. (reading and change of files is not only IRP_MJ_READ and IRP_MJ_WRITE, there are also other requests which too should be supported for a coordination). It works irrespectively, whether the cache or not (FILE_FLAG_NO_BUFFERING) is used, whether files by means of ReadFile/WriteFile or through MMF, etc. With MMF, of course, a bit separate "song" are read: 1. The Read and write in the buffer will be visible in the minifilter as paging read and paging write accordingly, and FILE_OBJECT can be at all what was expected, in particular it concerns record (and disk writing can fulfill, for example, mapped page writer - selected a system flow). 2. After application creates section and file contents in storage, it can close the source file, and also sections then to work with a file only through the the buffer. I.e. it is not necessary to think that, for example, after IRP_MJ_CLEANUP file "life" comes to an end and in it anybody cannot write down anything any more. 3. If application does not cause FlushViewOfFile explicitly, paging write in MMF can not come hours and in the days, as well as IRP_MJ_CLOSE. This normal behavior, system is not present any need "simply so" to drop on a disk, it is normal it at disk extraction, end of operation or if there are no resources. Whether E> probably to add flag IRP_NOCACHE to reading \record operations to pass a cache? Hardly it is possible. No, well i.e. you, of course, can add a flag, but it does not give desirable effect or leads to absolutely other effects By the way, for some types of files the given flag generally is ignored. I mean compressed, and also scrambled (EFS) files.