Inspect Storage Filter Drivers Using Regedit

Filter drivers modify or monitor I/O requests sent to storage devices and volumes, enabling software like antivirus programs, encryption tools, and backup utilities to interact directly with the storage stack. By using the Windows Registry Editor (regedit), administrators can identify and inspect both upper and lower filter drivers attached to storage volumes by locating the specific device class GUIDs and checking their filter configurations.

Step 1: Open the Registry Editor

1. Press Win + R to open the Run dialog.
2. Type regedit and press Enter.
3. Confirm the User Account Control (UAC) prompt if prompted.

Step 2: Navigate to the Device Classes Key

In the Registry Editor, navigate to the following path in the left navigation pane:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class

This container holds GUID-based subkeys representing every hardware and device class configured on the system.

Step 3: Locate Storage-Related Class GUIDs

To inspect storage volumes and disk-level drivers, locate the corresponding Class GUIDs:

• Storage Volumes: {71a27cdd-812a-11d0-bec7-08002be2092f}
  Contains filter drivers directly attached to logical volumes.
• Disk Drives: {4d36e967-e325-11ce-bfc1-08002be10318}
  Contains filter drivers monitoring physical disk drives.
• Volume Snapshot: {533c5b84-ec70-11d2-9505-00c04f79deaf}
  Contains filter drivers handling Volume Shadow Copy services.

Step 4: Examine UpperFilters and LowerFilters

Click on the target Class GUID (such as {71a27cdd-812a-11d0-bec7-08002be2092f}) and review the values in the right pane:

• UpperFilters (REG_MULTI_SZ): Lists driver services loaded above the primary functional volume driver. These drivers process I/O requests before they reach the main storage driver.
• LowerFilters (REG_MULTI_SZ): Lists driver services loaded below the primary driver, processing I/O requests right before they pass to the underlying bus or disk driver.

Double-click on either UpperFilters or LowerFilters to view the list of registered driver names. Standard Windows drivers like volsnap often appear here, alongside third-party storage or security drivers.

Step 5: Verify Driver Details in the Services Key

To cross-reference an identified filter driver name with its actual system binary:

1. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<DriverName>.
2. Check the ImagePath value to view the file location (typically under System32\drivers\).
3. Check the DisplayName and Description strings to identify the vendor and associated software.