6 min read
|
Saved February 14, 2026
|
Copied!
Do you care about this?
This article explains the Projected File System (ProjFS) in Windows, which allows virtual files to be projected from a backing datastore. It covers the system's architecture, how it operates, and its potential use cases for offensive and defensive applications.
If you do, here's more
The Projected File System (ProjFS) is a feature introduced in Windows 1809 that allows files and folders from a backing datastore to be projected into the file system. It makes these virtual files appear as though they exist on disk. When you access a projected file, ProjFS fetches the actual data on-demand, a process referred to as "hydrating." To set up ProjFS, you need to enable the feature using PowerShell, ensure the ProjFS driver is installed, and create a provider application that defines what gets projected.
ProjFS operates as a minifilter and utilizes reparse points to identify its files. It has two specific reparse point tags: IO_REPARSE_TAG_PROJFS for active files and IO_REPARSE_TAG_PROJFS_TOMBSTONE for deleted items, preventing them from being re-projected. The system supports various notifications for file operations, such as creation or deletion, allowing developers to monitor actions taken on these virtual files. This is particularly useful for logging and security, as you can track unauthorized attempts to access or modify files.
Communication between the ProjFS provider and the minifilter happens through filter communication ports. The ProjFS driver has a filter altitude of 189800, which can be verified using tools like fltmc.exe. The provider communicates with the minifilter through callbacks, enabling a rich interaction model for file operations. Overall, ProjFS provides a way to manage file virtualization efficiently, offering both operational benefits and security capabilities.
Questions about this article
No questions yet.