Hello I want to monitor read and write operations from CDROM (on win xp and 2000).[QUOTE] From what I've read so far, I understand that I need an upper filter[/QUOTE] driver over scsiport.sys, and to monitor writing for example I need to check for IOCTL_SCSI_PASS_THROUGH. Is this correct? Any guidance on how to do it? Does this method monitor writing from all burning programs? Can anyone supply me with information about ASPI, IMAPI and why CD writing is done through the SCSI bus and not through the cdrom driver? Thanks, Sharon