TMprefilter and MiniFilter are the mechanisms to hook I/O events provided by Microsoft Windows.

TmPrefilter MiniFilter mode

MiniFilter mode is also known as Filter Manager mode. Filter Manager is a component of Microsoft Windows starting from XP SP2. It allows vendors who want to hook I/O events to register the MiniFilter driver as a plug-in. Filter Mangager will then dispatch I/O events to every MiniFilter driver.

For more information, refer to the following Microsoft article: Filter Manager Concepts.

Difference between running TmPrefilter in normal mode and MiniFilter-Mode

Normal mode is also known as legacy mode. Legacy filter driver is provided by Windows as another way to hook I/O events. Windows provided the legacy filter driver after Windows 2000.

For more information, refer to the this Microsoft article: Filter Manager Concepts.

Advantages and disadvantages of running TmPrefilter in MiniFilter-mode

In MiniFilter mode, Windows will handle the hooking of I/O events. Because MiniFilter is designed as plug and play, the MiniFilter driver can be unloaded. TmPreFilter running in MiniFilter mode can be updated without doing a reboot.

For more information, refer to the this Microsoft article: Advantages of the Filter Manager Model

Advantages and disadvantages of running TmPrefilter in normal mode

In legacy mode, the filter driver cannot be unloaded. TmPreFilter running in legacy mode has to perform a reboot after a driver update.

For more information, refer to the this Microsoft article: Guidelines for Porting Legacy Filter Drivers

When is it recommended to use the MiniFilter mode?

If tmprefilter needs to be unloaded, it is recommended to use the MiniFilter mode.

Why is it recommended to use the MiniFilter mode?

MiniFilter mode is a new way to hook I/O events. Although Windows supports both filter driver modes, it is highly recommended to use MiniFilter mode. Windows can do more checks in MiniFilter mode to ensure system stability.

Platform support for TmPrefilter in MiniFilter mode

MiniFilter mode is supported starting from Windows XP SP2.