Assume you want to intercept IRP_MJ_WRITE IRPs sent to drivervolmgr, in particular, the device for the root partition (for example C:), and you want to monitor any writes to starting sector of this device (VBR).