Download EaseFilter Filter Driver SDK Setup File Download EaseFilter Filter Driver SDK Zip File
Microsoft Windows XP, Windows 2000 SP4 with Update Rollup 1, and later operating systems provide a dedicated set of load order groups for file system filter drivers and minifilter drivers that are loaded at system startup.
Legacy file system filter drivers can attach only to the top of an existing file system driver stack and cannot attach in the middle of a stack. As a result, the start type for a driver and load order group are important to legacy file system filter drivers, because the earlier a filter driver loads, the lower it can attach on the file system driver stack.
Drivers are loaded first based on the start type for the driver, which represents phases of booting a system. For more information about start types, see "Driver Start Types" in What Determines When a Driver Is Loaded. All file system filter drivers and minifilter drivers that specify a start type of SERVICE_BOOT_START will be loaded before drivers with a start type of SERVICE_SYSTEM_START or SERVICE_AUTO_START. The start type is specified by the StartType entry in the ServiceInstall Section of an INF file that is used to install the minifilter driver. Within each start type category, the load order group determines when file system filter drivers and minifilter drivers will be loaded.
A minifilter driver can be loaded at any time. The concept of load order groups is still required by minifilter drivers for interoperability with legacy file system filter drivers. Every minifilter driver must have a unique identifier called altitude. The altitude of a minifilter driver defines its position relative to other minifilter drivers in the I/O stack when the minifilter driver is loaded. The altitude is an infinite-precision string interpreted as a decimal number. A minifilter driver that has a low numerical altitude is loaded into the I/O stack below a minifilter driver that has a higher numerical value.
Each load order group has a defined range of altitudes. The allocation of altitudes to minifilter drivers is managed by Microsoft. To request an altitude for your minifilter driver, go to the WHDC Minifilter Altitude Allocation website.
A minifilter driver must specify an altitude value from an altitude range that represents a load order group. Altitude values for a minifilter driver are specified in the Instance definitions of the Strings Section in the INF file that is used to install the minifilter driver. Instance definitions can also be specified in calls to the InstanceSetupCallback routine in theFLT_REGISTRATION structure. Multiple instances and altitudes can be defined for a minifilter driver. These instance definitions apply across all volumes.
The following rules about start type and load order groups determine when a minifilter driver will be loaded:
A minifilter driver that specifies a particular start type and load order group is loaded at the same time as other file system filter drivers and minifilter drivers in that start type and load order group.
Within each load order group, file system filter drivers and minifilter drivers are generally loaded in random order. This normally results in drivers being loaded based on the order in which the driver was installed.
If a file system filter driver or minifilter driver does not specify a load order group, it is loaded after all the other drivers of the same start type that do specify a load order group.
The following table lists the system-defined load order groups and altitude ranges for minifilter drivers. For each load order group, the Load order group column contains the value that should be specified for that group in theLoadOrderGroup entry in the ServiceInstall Section of a minifilter's INF file. The Altitude range column contains the range of altitudes for a particular load order group. A minifilter driver must request an altitude allocation from Microsoft in the appropriate load order group or groups.
Note that the load order groups and altitude ranges are listed as they appear on the stack, which is the reverse of the order in which they are loaded.
| Load order group | Altitude range | Description |
|---|---|---|
Filter |
420000-429999 |
This group is the same as the Filter load order group that was available on Windows 2000 and earlier. This group loads last and thus attaches furthest from the file system. |
FSFilter Top |
400000-409999 |
This group is provided for filter drivers that must attach above all other FSFilter types. |
FSFilter Activity Monitor |
360000-389999 |
This group includes filter drivers that observe and report on file I/O. |
FSFilter Undelete |
340000-349999 |
This group includes filters that recover deleted files. |
FSFilter Anti-Virus |
320000-329999 |
This group includes filter drivers that detect and disinfect viruses during file I/O. |
FSFilter Replication |
300000-309999 |
This group includes filter drivers that replicate file data to remote servers. |
FSFilter Continuous Backup |
280000-289999 |
This group includes filter drivers that replicate file data to backup media. |
FSFilter Content Screener |
260000-269999 |
This group includes filter drivers that prevent the creation of specific files or file content. |
FSFilter Quota Management |
240000-249999 |
This group includes filter drivers that provide enhanced file system quotas. |
FSFilter System Recovery |
220000-229999 |
This group includes filter drivers that perform operations to maintain operating system integrity, such as the System Restore (SR) filter. |
FSFilter Cluster File System |
200000-209999 |
This group includes filter drivers that are used in products that provide file server metadata across a network. |
FSFilter HSM |
180000-189999 |
This group includes filter drivers that perform hierarchical storage management. |
FSFilter Imaging |
170000-175000 |
This group includes ZIP-like filter drivers that provide a virtual namespace. This load group is available on Windows Vista and later versions of the operating system. |
FSFilter Compression |
160000-169999 |
This group includes filter drivers that perform file data compression. |
FSFilter Encryption |
140000-149999 |
This group includes filter drivers that encrypt and decrypt data during file I/O. |
FSFilter Virtualization |
130000- 139999 |
This group includes filter drivers that virtualize the file path, such as the Least Authorized User (LUA) filter driver added in Windows Vista. This load group is available on Windows Vista and later versions of the operating system. |
FSFilter Physical Quota Management |
120000-129999 |
This group includes filter drivers that manage quotas by using physical block counts. |
FSFilter Open File |
100000-109999 |
This group includes filter drivers that provide snapshots of already open files. |
FSFilter Security Enhancer |
80000-89999 |
This group includes filter drivers that apply lockdown and enhanced access control lists (ACLs). |
FSFilter Copy Protection |
60000-69999 |
This group includes filter drivers that check for out-of-band data on media. |
FSFilter Bottom |
40000-49999 |
This group is provided for filter drivers that must attach below all other FSFilter types. |
FSFilter System |
20000-29999 |
Reserved for internal use. |
FSFilter Infrastructure |
Reserved for internal use. This group loads first and thus attaches closest to the file system. |