how to handle IRP_MN_QUERY_DEVICE_RELATIONS

See more:

USB

driver

Hello All.
I am new in driver development.
I started to develop usb filter driver for Windows7 in order to hide from user some usb device types. I have a few questions:

1 - On IRP_MN_QUERY_DEVICE_RELATIONS (QueryDeviceRelations.Type is BusRelations) I receive a pointer to DEVICE_RELATIONS struct.As I understand the Objects array in the struct should hold pointers to PDOs. But, when I test DO_BUS_ENUMERATED_DEVICE flag (From msdn: The operating system sets this flag in each physical device object (PDO). Drivers must not modify this flag.) sometime I see this flag is turned on, and some time the flag is turned off. Does it means that sometime I see PDO and sometime I see FDO? Or the issue has another explanation?

2 - When the user plugs in some usb device, and the filter driver should handle IRP_MN_QUERY_DEVICE_RELATIONS, how can I determine which device from Object array is just now plugged in device and which one was plugged in before, and which one is marked as inactive?

Thanks in advance.
Felix.