Implement secondary encryption at the file payload level within the encrypted volume

[Yeyixiao]

We can intercept the application's IRP_MJ_READ/WRITE requests to files in the encrypted volume within the minifilter, and use the NTFS FileId/ObjectId (which we can obtain by calling FltRequestFileInfoOnCreateCompletion in IRP_MJ_CREATE and cache in the file object context) as the Nonce, then employ AES-CTR, a stream cipher mode, to perform transparent encryption and decryption.