Windows File-System Minifilters: Filter Manager, Altitudes, and I/O Interception
A driver-engineering guide to Windows minifilter registration, operations, instances, altitudes, pre/post callbacks, contexts, communication, and testing.
A Windows file-system minifilter registers with Filter Manager to observe or modify selected I/O operations above one or more file-system volumes. Antivirus, encryption, replication, auditing, and virtualization products use minifilters because Filter Manager supplies attachment, ordering, context, and communication infrastructure. A callback still runs on sensitive kernel I/O paths where blocking, recursion, and lifetime mistakes can deadlock or crash the system.
Registration declares the operation surface
A minifilter’s FLT_REGISTRATION structure identifies unload and instance callbacks, context types, and a list of I/O operations with preoperation and optional postoperation callbacks. FltRegisterFilter registers the driver; FltStartFiltering allows instance setup and I/O callbacks to begin.
Initialize all global state and communication endpoints needed by callbacks before starting filtering. After FltStartFiltering, another thread can enter a callback immediately. On unload, prevent new work, drain queued operations, close communication ports, release contexts, and unregister in the documented order.
Register only operations required by the product. Intercepting every IRP major function “for future use” adds overhead and expands the correctness surface. Fast I/O, cached and noncached paths, memory-mapped I/O, paging I/O, cleanup, close, rename, and reparse behavior can interact; one CreateFile test is not coverage.
Altitude determines relative order
Each filter has an altitude string assigned/managed through Microsoft’s filter-altitude process. Filter Manager orders instances by altitude within load-order groups. A higher or lower number is not a general quality ranking; ranges correspond to filter categories and ordering semantics.
Do not copy another vendor’s altitude or invent a collision. During development, follow Microsoft’s guidance for assigned/test altitudes. Ordering affects what a filter observes: an encryption filter, antivirus scanner, and virtualization layer may see different representations depending on relative position. Test with the real third-party stack deployed by customers.
Instances attach to volumes under InstanceSetup policy. Volume type, file-system type, sector behavior, read-only state, and product configuration can accept or reject attachment. Network redirectors and special volumes may not support assumptions valid on local NTFS.
Callbacks must respect IRQL and reentrancy
A preoperation callback can pass through, complete the request, request a postoperation callback, pend work where allowed, or request synchronization under documented constraints. The callback’s IRQL and operation flags determine which APIs and waits are legal. Never hold a global lock while issuing file I/O that can reenter the filter and request the same lock.
Use Filter Manager contexts for per-instance, volume, file, stream, stream-handle, or transaction state as appropriate. Reference and release them exactly. Store immutable or synchronized state, and account for cleanup/close arriving after failures and for files with multiple handles or names.
Kernel-to-user communication through Filter Manager ports can offload policy or scanning, but a user service can hang or disappear. Bound message size and wait time, authenticate the connecting process through supported security, define fail-open/closed behavior per operation, and avoid holding scarce kernel resources across an unbounded decision.
Verification needs hostile I/O
Use Driver Verifier settings appropriate to filter drivers, checked test machines/VM snapshots, kernel dumps, Filter Manager tools such as fltmc, and ETW/WPP tracing. Exercise low disk, memory pressure, cancellation, oplocks, alternate streams, hard links, reparse points, transactions where supported, network shares, containers, paging, hibernation, and abrupt service death.
A trustworthy minifilter minimizes interception, has an assigned ordering contract, never assumes one pathname equals one file identity, and can survive every user-mode dependency failing. Filter Manager structures the stack; it cannot make unsafe callback logic safe.
Related:
- ReFS on Windows: Integrity Streams, Scrubbing, Block Cloning, and Deployment Limits
- How to Apply Microsoft Security Baselines Without Overwriting Business Requirements
Sources: