I have a upper filter driver,and it is used to create a differential using the volume bitmap file, which is created and changed in my filter that is attached to my UpperFilter. Thus, when it is necessary to create a differential image, I take full volume image and my volume bitmap file, which retained all the changes since the last full image. In the bitmap changes are tracked by sector. To read data from the volume using the Volume Shadow Service. problem is that I do not get in the packet filter information for some clusters. I see that the data in these clusters on the volume and the snapshot has changed, but the filter has not received packets IRP_MJ_WRITE for these clusters. Therefore, the differential image is created "broken." Packages in the filter processes in WriteCompletionRoutine. To determine the initial cluster and the total number of clusters using the field ioStackLocation-> Parameters.Write.ByteOffset and ioStackLocation-> Parameters.Write.Length. problems observed in recent versions of Windows. Specifically test on WIndows 7 and Windows Server 2008 R2 x64. On XP such problems do not watch. Tried to install the filter as LowerFilter, but the bug still remains. Some packages filter does not see. possible to change the data on the volume to pack IRP_MJ_WRITE not created? How can it be that the data on the volume change, and the filter does not know about?