I/O Completions port
While in theory this is easy to do, by just calling KeDelayExecutionThread in the write handler, the system is very likely to have problems if you do this. What is the purpose of this delay? Could you take the data, and hold it while indicating that the data was written, then have a worker thread do the write in 60 seconds?
You can control the pending of one file, by catching the IRP_MJ_CREATE you can detect what file it is. You add a context to the file and then in the write calls, you can check for the context and issue the KeDelayExecutionThread. There are no samples for something like this, as I said it is a pretty weird requirement, you should be able to use one of the minifilter samples from the WDK as a starting point.
In the preoperation callback for the write to the file you have identified.
Yes the mini-filter will see all operations of all processes. Take the minispy WDK sample, build and install it. The sample gives you a log of operations.
