Control file operations
File activity must be observed, permitted, blocked or transformed at the file-system layer.
WINDOWS SYSTEM FILTERS
Windows file, storage and network filter-driver development
Kernel-level interception for data protection, access control, auditing, encryption, virtualization and network policy — implemented without breaking the Windows lifecycle.
When it is needed
Problems a user-mode agent cannot reliably solve
Protect the storage path
Encryption, snapshots, virtualization, auditing or policy is required at disk, volume or block level.
Enforce Windows network policy
Traffic must be classified or filtered through Windows Filtering Platform while coexisting correctly with the rest of the stack.
Scope
Filter and system-component types
- File-system minifilters: create, read/write, rename, delete, metadata and contexts
- Storage and volume filters, virtual disks and block-I/O control
- WFP callout drivers, flow classification and user-mode policy integration
- Transparent encryption, auditing, DLP scenarios and protection against unauthorized operations
- Recursion bypass, system-process exclusions, caching and state consistency
- WinDbg, Filter Manager diagnostics, Driver Verifier, ETW and load testing
Primary risks
A filter must stay invisible to valid operations
Operation semantics
Define a logical operation under caching, memory-mapped I/O, rename, hard links and repeated requests.
Ordering and recursion
Account for other filters, re-entry, internal service I/O and bypass rules to avoid loops.
State and contexts
Manage file, stream and instance context lifetimes, policy transactions and safe configuration updates.
Performance
Minimize synchronous transitions, allocation, copying and global locks on the hot path.
Failure behavior
Define behavior when the user-mode service is unavailable, memory is low, the driver unloads, power changes or a volume disappears.
Compatibility
Validate on target Windows versions, file systems, endpoint-security software, backup products and real workloads.
PROJECT EXAMPLE
What a verifiable result looks like
The anonymized example shows the form of the outcome and validation without exposing a customer or confidential code.
Initial situation
An encryption file-system filter occasionally generated recursive operations and sharply increased latency alongside antivirus and backup software.
Work performed
Internal and external I/O were separated, contexts, policy caching, and asynchronous audit were redesigned, and recursion guards were added.
Result
Repeated interception was removed and filtering overhead became measurable and stable on production-like workloads.
Validation
Operation tracing, compatibility tests, dependent-service failures, and before-and-after latency measurements.
How to start
The riskiest interception point is validated first
Filter design
Interception points, semantics, exclusions, failure model and measurement plan.
Existing-filter diagnostics
Dump or trace analysis, reproduction, recursion/race investigation, fix and regression.
Minimal filter
One target scenario, user-mode policy, telemetry and load validation.
The minimum paid engagement is three working days, starting from RUB 200,000 or the equivalent in another currency. After a short introductory call, scope, deliverable, validation method and price are fixed.
Before the project starts
Windows filter driver FAQ
Minifilter or legacy file-system filter?
Filter Manager minifilters are generally the default for new file-system filters. The legacy model is mainly relevant when maintaining existing code or meeting unusual constraints.
Can policy run entirely in user mode?
Some logic can live in a service, but the hot path should not depend on a synchronous round trip without a strong reason. Caching, timeouts and explicit service-failure behavior are required.
How are antivirus and backup conflicts avoided?
Filter ordering, operation types, reparse behavior, memory-mapped I/O and internal service traffic must be considered. Compatibility is validated against the actual product set and scenarios.
How much performance overhead does a filter add?
It depends on the interception point and policy complexity. Overhead is measured against an agreed I/O profile, with goals and acceptable limits defined before optimization.
Engagement model
KernelSoft is an independent expert practice
Maxim personally leads architecture, critical implementation, diagnostics and final technical validation. Additional engineers or domain specialists are involved only with the customer’s agreement and with explicit roles and responsibility.
28+years of experience
60+patents
14years at Acronis
2 400+citations
Discuss the project
Describe the interception point, policy and acceptable I/O overhead
Include the platform, what already exists, where the problem occurs, the target load and the acceptance criterion. This is enough to choose a sensible first stage and validation method.
Target response time: one business dayNext: a short introduction → an NDA if needed → agreement on the first stage.