How File System Filter Drivers Are Similar to Device Drivers
The following subsections describe some of the similarities between file system filter drivers and device drivers in the Microsoft Windows operating system.
Like device drivers, file system filter drivers have DriverEntry, dispatch, and I/O completion routines. They call many of the same kernel-mode routines that device drivers call, and they filter I/O requests for devices (that is, file system volumes) with which they are associated.
Because file system filter drivers and device drivers are part of the I/O system, they both receive I/O request packets (IRPs) and act on them.
Like device drivers, file system filter drivers can also create their own IRPs and send them to lower-level drivers.
Both kinds of drivers can register for notification (by using callback functions) of various system events.
Like device drivers, file system filter drivers can receive Introduction to I/O Control Codes (IOCTLs). However, file system filter drivers can also receive--and define--file system control codes (FSCTLs).
Like device drivers, file system filter drivers can be configured to be loaded at system startup time or to be loaded later, after the system startup process is complete.