NTFS File System Driver

As described in Chapter 7, in the framework of the Windows I/O system, NTFS and other file systems are loadable device drivers that run in kernel mode. They are invoked indirectly by applications that use Windows or other I/O APIs (such as POSIX). As Figure 11-21 shows, the Windows environment subsystems call Windows system services, which in turn locate the appropriate loaded drivers and call them. (For a description of system service dispatching, see the section System Service Dispatching in Chapter 3.)

Components of the Windows I/O system

Figure 11-21. Components of the Windows I/O system

The layered drivers pass I/O requests to one another by calling the Windows ...

Get Windows Internals, Fifth Edition now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.