The reason why I gave the short answer 'no', is because this way is difficult and there's a big risk for messing up the file system making the machine impossible to boot. I strongly recommend that you seriously try to find another solution. In any case, if you continue the filter driver track, I cannot help you. As for your questions...
chandni_chandrakant_maheta wrote:
can I keep watch on a process by file system filter driver?
Not exactly, you'd have to filter the file accesses from all processes. You may do the filtering in the driver.
chandni_chandrakant_maheta wrote:
According to me, if we load a filter driver, we need to restart the computer.
Correct in this case since it's about filtering the file system driver.
"It's supposed to be hard, otherwise anybody could do it!" - selfquote
"High speed never compensates for wrong direction!" - unknown