how to handle IRP_MN_QUERY_DEVICE_RELATIONS

Hello All.
I am new in driver development.
I started to develop usb filter driver for Windows7 in order to hide from user some usb device types. I have a few questions:

1 - On IRP_MN_QUERY_DEVICE_RELATIONS (QueryDeviceRelations.Type is BusRelations) I receive a pointer to DEVICE_RELATIONS struct.As I understand the Objects array in the struct should hold pointers to PDOs. But, when I test DO_BUS_ENUMERATED_DEVICE flag (From msdn: The operating system sets this flag in each physical device object (PDO). Drivers must not modify this flag.) sometime I see this flag is turned on, and some time the flag is turned off. Does it means that sometime I see PDO and sometime I see FDO? Or the issue has another explanation?

2 - When the user plugs in some usb device, and the filter driver should handle IRP_MN_QUERY_DEVICE_RELATIONS, how can I determine which device from Object array is just now plugged in device and which one was plugged in before, and which one is marked as inactive?

Thanks in advance.
Felix.

Tags: USB, Driver