Knowledge Base
Guides, FAQs, and troubleshooting for Callback Technologies products.
CBFS™ Filter
60 articles
A Commercial Alternative to Sysmon You Can Build Into Your Application
Blocking Data Exfiltration to USB Drives with CBFS Filter
File Integrity Monitoring for Compliance with CBFS Filter
Building a Ransomware Honeypot with CBFS Filter
Restricting File Access by User or Group with CBFS Filter
Secure File Deletion (Data Shredding) with CBFS Filter
CBFS Filter 2026 API Changes
Can I create files and directories that don't really exist on disk using CBFS Filter?
Improving Speed of Scanning Files Before Opening
Processing File Changes with CBFS Filter
See more (50)... Show less
What Windows versions are supported by the components?
What happens if a certificate used to sign the driver and the DLL expires?
Protecting Registry Keys with Default and Access Rules
Selective Encryption with CBFS Filter
Implementing Virtual Files with CBFS Filter
Creating a Replacement for FileSystemWatcher
Overview of Process Monitoring with CBFS Filter
Tracking Process Creation with CBFS Filter
Overview of Registry Monitoring with CBFS Filter
Access and Default Rules in CBFS Filter
Backing Up File Data with CBFS Filter
Control Capabilities of CBFS Filter
Monitoring Capabilities of CBFS Filter
Direct File Access with CBFS Filter
Redirection of File Access with CBFS Filter
Handling Filenames in CBFS Filter
Hiding Files and Folders with CBFS Filter
Overview of File Filtering with CBFS Filter
Protecting Files and Folders with CBFS Filter
Removable Devices and Per-Volume Rules
Tracking and Controlling Access to Network Resources with CBFS Filter
Tracking and Controlling Network Access to Local Files with CBFS Filter
CBFS Filter 2024 API Changes
CBFS Filter File Isolation
File Isolation in CBFS Filter
CBFS Filter 2022 API Changes
Why are On*CloseFile events fired long after the file is actually closed?
How do I protect my process or thread from being suspended/paused or terminated?
Why driver deinstallation or update require system restart?
How do I protect directory contents from modifications?
How do I prevent file deletion using filter rules?
How can I use CBProcess to prevent a process from being started?
FileSystemWatcher and ReadDirectoryChangesW vs. CBFS Filter
How can I create a file in a directory protected with a read-only access rule?
Is it possible to create nested virtual directories?
How can I attach the filter to a USB drive?
I get a BSOD with the error code NO_MORE_IRP_STACK_LOCATIONS (35). What's that?
In some cases I get a filename in ALL CAPS. What's wrong?
Can I use the GetOriginator* methods in the Notify* events?
How can I make a directory read-only, but have its subdirectories be read-write?
How can I monitor the files in a directory, but not its subdirectories?
How do I track file copying?
Is there any integrity check to validate which process is using CBFS Filter?
Why doesn't my application receive events for mapped network drives?
Is CBFilter a minifilter driver?
I need to monitor file operations on a server. Is this possible with CBFS Filter?
How do I know which user initiated a filesystem event?
Does the driver need to be reinstalled each time the computer reboots?
Why doesn't returning error in the DeleteFile event handler prevent file deletion?
Can you provide a WHQL-signed version of the driver?