Windows Projected File System (ProjFS) Internals: A Technical Deep Dive

This report analyzes Windows Projected File System (ProjFS) internals and behavior, detailing its implementation as a minifilter, use of reparse points, supported notifications, and provider–kernel communication. It demonstrates practical applications—such as blocking deletes, altering or denying reads per process via GetFileDataCallback, and building effective canary files—emphasizing defensive telemetry benefits (e.g., tracking triggering process IDs and images) without deploying a kernel minifilter.