Legacy and MiniFilter modes
Main operation mode for CallbackFilter is Legacy mode.
Drivers in Legacy mode are attached to the top of the stack of filesystem filter drivers. Such drivers include all filtering logic in them and so they are very flexible in their operations. Legacy mode has certain limitations when it comes to driver deactivation (eg. during deinstallation) and when you need to control the order in which the requests are filtered (eg. content analysis filter must sit on top of encryption filter).
Some low-level software applications (disk mirroring systems etc) refuse to work or works in compatibility mode when presence of legacy filter is detected.
Minifilter architecture, offered by Microsoft, includes a framework that implements a filter driver itself. The framework manages so-called minifilters which implement small part of filtering functionality. Such architecture lets one implement minifilters easier and makes the OS more stable. At the same time minifilters are not as flexible as legacy filters and don't let one implement some functions possible with Legacy drivers.
In Minifilter mode each filesystem filter driver must have a pre-set Altitude.
Since version 3.1 CallbackFilter can work in both modes, though Virtual Files feature works only in Legacy mode.