Find Storage Volume Filter Drivers in Regedit

This article explains how to locate and inspect the active upper and lower filter drivers associated with storage volumes using the Windows Registry Editor (Regedit). In Windows, filter drivers intercept, monitor, or modify input/output requests sent to storage devices, and their system-wide registrations are organized under specific device class globally unique identifiers (GUIDs) in the system registry.

Registry Location for Storage Volume Filter Drivers

To inspect the class-level filter drivers configured for storage volumes, open the Registry Editor (regedit.exe) and navigate to the following key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71a270c8-ad83-410e-8622-0479e073a7c6}

The GUID {71a270c8-ad83-410e-8622-0479e073a7c6} represents the Volume device class in Windows.

Values to Inspect

Within this key, examine the following Multi-String (REG_MULTI_SZ) values in the right-hand pane:

• UpperFilters: Lists drivers loaded above the primary volume functional device driver. Common examples include antivirus monitors, volume shadow copy drivers (volsnap), or encryption tools (such as BitLocker’s fvevol).
• LowerFilters: Lists drivers loaded beneath the functional driver and above the underlying disk device stack.

If neither value exists, only the default Windows subsystem drivers handle the volume requests.

Inspecting Specific Volume Device Instances

If filter drivers are attached to specific volume instances rather than the entire device class, they are stored under the device enumeration keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\STORAGE\Volume

Expand the individual volume subkeys (identified by unique GUIDs) to locate device-specific UpperFilters or LowerFilters entries.

Identifying the Filter Driver Service

The entries listed inside UpperFilters and LowerFilters correspond to the service names of the installed drivers. To view the file path, startup type, and details of any listed driver, navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<DriverName>

Replace <DriverName> with the exact string found in the filter list (for example, volsnap or rdyboost). The ImagePath value inside this key points directly to the .sys file executing on the system.