NTFS File System Driver
As described in Chapter 7, in the framework of the Windows I/O system, NTFS and other file systems are loadable device drivers that run in kernel mode. They are invoked indirectly by applications that use Windows or other I/O APIs (such as POSIX). As Figure 11-21 shows, the Windows environment subsystems call Windows system services, which in turn locate the appropriate loaded drivers and call them. (For a description of system service dispatching, see the section System Service Dispatching in Chapter 3.)
Figure 11-21. Components of the Windows I/O system
The layered drivers pass I/O requests to one another by calling the Windows ...