File System Filter Drivers vs Device Drivers

The following subsections describe some of the differences between file system filter drivers and device drivers.

No Power Management

Because file system filter drivers are not device drivers and thus do not control hardware devices directly, they do not receive IRP_MJ_POWER requests. Instead, power IRPs are sent directly to the storage device stack. In rare circumstances, however, file system filter drivers might interfere with power management. For this reason, file system filter drivers should not register dispatch routines for IRP_MJ_POWER in theDriverEntry routine, and they should not call PoXxx routines.

No WDM

File system filter drivers cannot be Windows Driver Model (WDM) drivers. The Microsoft Windows Driver Model is only for device drivers. For more information about file system driver development in Windows Me, Windows 98, and Windows 95, see the Windows Me Driver Development Kit (DDK).

No AddDevice or StartIo

Because file system filter drivers are not device drivers and thus do not control hardware devices directly, they should not have AddDevice or StartIo routines.

Different Device Objects Created

Although file system filter drivers and device drivers both create device objects, they differ in the number and kinds of device objects that they create.

Device drivers create physical and functional device objects to represent devices. The Plug and Play (PnP) Manager builds and maintains a global device tree that contains all device objects that are created by device drivers. The device objects that file system filter drivers create are not contained in this device tree.

File system filter drivers do not create physical or functional device objects. Instead, they create control device objects and filter device objects. The control device object represents the filter driver to the system and to user-mode applications. The filter device object performs the actual work of filtering a specific file system or volume. A file system filter driver normally creates one control device object and one or more filter device objects.

Other Differences

Because file system filter drivers are not device drivers, they do not perform direct memory access (DMA).

Unlike device filter drivers, which can attach above or below a target device's function driver, file system filter drivers can attach only above a target file system driver. Thus, in device-driver terms, a file system filter driver can be only an upper filter, never a lower filter.

ref:

http://msdn.microsoft.com/en-us/library/ff548075(v=vs.85).aspx

Sample Filter Driver code -

http://read.pudn.com/downloads2/sourcecode/windows/system/4397/WinntInternalFS/filesys/src/sfsdinit.c__.htm

http://read.pudn.com/downloads27/sourcecode/windows/system/86694/CallMsgRing0/CallMsgRing0.c__.htm

http://www.google.com/url?sa=t&source=web&cd=17&ved=0CDYQFjAGOAo&url=http%3A%2F%2Fwww.mglife.ru%2Fpub%2Finfo%2F%25D0%25A3%25D1%2587%25D0%25B5%25D0%25B1%25D0%25BD%25D0%25B8%25D0%25BA%25D0%25B8%2F3%2F6%2FTemp%2FTrueCrypt%2520v4.2a%2520source%2FTrueCrypt%2FDriver%2FNtdriver.c&rct=j&q=IoRegisterShutdownNotification%20C%20code&ei=iz8BTpCZHIKutwfi5LyDDg&usg=AFQjCNGp87K_UESdkXWKxQ-NPRZTe5CL8Q&sig2=O9yhjBMU4klYADle9A7mKQ