Minifilter and Legacy Modes

The CBFilter and CBMonitor classs support two modes of operation for the filesystem filter driver: Minifilter and Legacy.

Minifilter Mode

Filesystem minifilter drivers are those which are built on top of Microsoft's minifilter architecture. This architecture is based around a system component called the filter manager that exposes a comprehensive framework upon which minifilters are built and managed. Each minifilter only needs to implement the portion of the filtering functionality that it requires, which in turn makes them easier to develop and allows the OS to provide better overall stability. Please refer to Microsoft's File System Minifilter Drivers articles for more information.

When operating in minifilter mode, each filesystem minifilter driver must have a pre-assigned altitude, which determines its position in the stack of filesystem filter drivers. Please refer to the Driver Altitudes topic for more information.

Legacy Mode

Legacy filesystem filter drivers are "monolithic" in style; they include all possible filtering functionality in them, which makes them flexible but also inefficient by nature. Additionally, legacy filesystem filter drivers have certain limitations regarding driver deactivation (e.g., during uninstallation) and control over the order in which requests are filtered. Please refer to Microsoft's File System Filter Drivers articles for more information.

Unlike minifilter drivers, legacy filesystem filter drivers don't use altitudes to determine their load order; when the class is operating in legacy mode, the filesystem filter driver is attached to the top of the stack of filesystem filter drivers (i.e., closest to user mode, furthest from the filesystem).

Note that some low-level third-party applications (disk mirroring systems, etc.) refuse to work in compatibility mode if any legacy filesystem filter drivers are detected.

IMPORTANT: Microsoft has declared legacy filesystem filter drivers obsolete as of 2017, and provides official guidance on how to block them completely. It is expected that legacy filesystem filter drivers will be blocked by default in future Windows updates. CBFS Filter makes it easy to switch to Minifilter mode, and it is recommended that applications do so if possible, as support for legacy mode will be removed in a future product update.