Legacy and MiniFilter modes
Main operation mode for CallbackFilter is Legacy mode.
Drivers in Legacy mode are attached to the top of the stack of filesystem filter drivers. Such drivers include all filtering logic in them and so they are very flexible in their operations. Legacy mode has certain limitations when it comes to driver deactivation (eg. during deinstallation) and when you need to control the order in which the requests are filtered (eg. content analysis filter must sit on top of encryption filter).
Minifilter architecture, offered by Microsoft, includes a framework that implements a filter driver itself. The framework manages so-called minifilters which implement small part of filtering functionality. Such architecture lets one implement minifilters easier and makes the OS more stable. At the same time minifilters are not as flexible as legacy filters and don't let one implement many functions possible with Legacy drivers.
Some low-level software applications (disk mirroring systems etc) refuse to work or works in compatibility mode when presence of legacy filter is detected.
Since version 3.1 CallbackFilter can work in both modes, though Virtual Files feature works only in Legacy mode.