What is the Internet Café disk protection principle

Disk protection for ordinary users is a more magical technology, the user can be normal use of the computer, all the changes to the protection of the partition can be restarted after the hard drive data restore, in order to prevent viruses, protect hard disk data original function.

And how did all this happen? This will start with the disk-writing mechanism of the Windows system. We tend to intuitively feel, if the hard disk to write what data, it seems that the user directly write or when the application directly, obviously to a specified directory to write data, but why after the disk protection is enabled, after the reboot everything restored, all thanks to disk protection driver.

Drivers in our impression, it looks as if it's just a hardware device that can be recognized by Windows and made available to users. But in fact, the concept of "driver" is very broad, many drivers actually just invoke some of the system's kernel functions, the function of these drivers is not to drive the hardware, disk filter drive is to implement this function of the driver.

During the actual data write process, the application writes the write function that is provided by the operating system, and then the operating system is handed over to the file system driver, and later works on some other drive until the last disk-driven completion of the data is written. The disk-protected driver is a "filtering" driver. General filtering drivers, such as the driver for the Filemon tool, can monitor the read and write operations of a file, while the disk saver's filtering driver is more powerful, and in addition to monitoring the recognition data write operation, it can also change the direction of write operations as needed.

Nowadays, the mainstream Internet cafes game platform has a function called "penetrating Restore". The essence of this feature is actually the ability to use disk protection to drive changes in the direction of write operations. In general data and write operations, the filter driver changes its flow direction, and when the disk protection driver submits the data to the file system driver, the real changes are saved in a different location. The resulting write results are not actually enforced on the protected partition, but instead are written to other temporary locations, while some of the client program's write operations or local game updates will retain the modified content to the actual path.