how to handle IRP_MN_QUERY_DEVICE_RELATIONS in USB filter driver
===

I am new in driver development.
I started to develop usb filter driver for Windows7 in order to hide from user some usb device types. I attache my driver on USB hub and can intercept IRP_MN_QUERY_DEVICE_RELATIONS. I have a few questions:
 
1 - On IRP_MN_QUERY_DEVICE_RELATIONS (QueryDeviceRelations.Type is BusRelations) I receive a pointer to DEVICE_RELATIONS struct.As I understand the Objects array in the struct should hold pointers to PDOs. But, when I test DO_BUS_ENUMERATED_DEVICE flag (From msdn: The operating system sets this flag in each physical device object (PDO). Drivers must not modify this flag.) sometime I see this flag is turned on, and some time the flag is turned off. Does it means that sometime I see PDO and sometime I see FDO? Or some another explanation for this issue? When I get some PDEVICE_OBJECT, how can I know Is it PDO or FDO?
 
2 - When the user plugs in some usb device, and the filter driver should handle IRP_MN_QUERY_DEVICE_RELATIONS, how can I determine which device from Object array is just now plugged in device and which one was plugged in before, and which one is marked as inactive?
 
Thanks in advance.
Felix.