Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Why do so many partition management tools, like EASEUS Partition Master, Acronis Disk Director, etc. require their own drivers in order to run?

In other words, what do they need to do that cannot be accomplished without a dedicated driver?

Direct disk access is completely possible from user-mode in Windows, so I'm curious why these tools insist on installing a custom driver to do their work. What is the reason behind this?

share|improve this question
I just installed EaseUS PM Home Edition to take a peek... but I can't find any driver: nothing in the installed files, registry, or MS Info - what's the name of the driver file? – ckhan May 13 '12 at 7:02
@ckhan: Interesting... at one point I thought I saw epm-something-something.sys, but that was when I was doing a partitioning operation. I don't see it now. Let me look and see if I can find anything... – Mehrdad May 13 '12 at 7:39
@ckhan: Ah, I knew I wasn't going crazy. :-) It's \Windows\System32\epmntdrv.sys. – Mehrdad May 13 '12 at 8:04
I should note that not every program does this. (I haven't seen Paragon do this, for example.) And, programs which do do this, do so to different degrees... for example EASEUS's is very weird, because it bypasses everything and writes directly to the disk, even any drivers that might be present directly on top of the disk driver (such as FancyCache). I/O from EASEUS won't show up as Disk I/O, but as "other" I/O. – Mehrdad May 13 '12 at 8:29
As Mehrdad said, they are filter drivers so the program has exclusive disk access, which is needed when imaging or cloning the hard drive while in windows. Acronis does this also. Paragon uses hotcore3.sys in some of its product installations. – Moab May 13 '12 at 13:04

@David Schwartz has suggested it's because they're intercepting all disk access. That certainly sounds credible to me. But I'm wondering if that's the whole story. I've been poking around the EaseUS driver, empmntdrv.sys. A few things to note:

  1. It's loaded as soon as I start the UI, not actually partitioning anything.

  2. EaseUS forums have plenty of posts of people complaining that no partitions show up when they launch the UI, and the stock answer from EaseUS support is: re-install the driver. This makes me thing it's being used to actually read the table.

  3. Brought out the big-guns: PE Explorer to disassemble the driver file. Mostly greek to me, of course, but a few things do jump out. First, the symbol table shows the list of system calls made to ntoskrnel.exe, and that include mucking with symbolic links:

    ; Imports from ntoskrnl.exe
        extrn DbgPrint
        extrn ExAllocatePoolWithTag
        extrn ExFreePoolWithTag
        extrn IoBuildAsynchronousFsdRequest
        extrn IoBuildDeviceIoControlRequest
        extrn IoCreateDevice
        extrn IoCreateSymbolicLink
        extrn IoDeleteDevice
        extrn IoDeleteSymbolicLink
        extrn IoFreeIrp
        extrn IoFreeMdl
        extrn IoGetAttachedDeviceReference
        extrn IoGetDeviceObjectPointer
        extrn IofCallDriver
        extrn IofCompleteRequest
        extrn KeBugCheckEx
        extrn KeInitializeEvent
        extrn KeSetEvent
        extrn KeTickCount
        extrn KeWaitForSingleObject
        extrn MmMapLockedPagesSpecifyCache
        extrn MmUnlockPages
        extrn ObfDereferenceObject
        extrn ObfReferenceObject
        extrn RtlAnsiCharToUnicodeChar
        extrn RtlInitUnicodeString
        extrn RtlUnicodeStringToInteger
        extrn memcpy
        extrn memset

    Note also that these are not the filter driver routines, they're low-level IO ones. (Not FltGetDiskDeviceObject, rather IoGetDeviceObjectPointer.

  4. Even more snooping around found a few constants that might give more clues. Like most Windows compiled code, there's a hard ref to the PDB file, usually with the path on the computer that created it:


    That's probably the developer's actually project name: "win disk access driver" I think they need the driver to actually read the table in a way that's useful to them.

  5. Then there's this constant, which really looks interesting:


    That looked interesting enough that I tracked where it was referenced in the disassembled code, which took me here:

     0001051E  68C6190100                       push    L000119C6
     00010523  6A78                             push    00000078h
     00010525  50                               push    eax
     00010526  E85BFFFFFF                       call    SUB_L00010486
     0001052B  83C420                           add esp,00000020h
     0001052E  85C0                             test    eax,eax
     00010530  7404                             jz  L00010536
     00010532                           L00010532:
     00010532  33C0                             xor eax,eax
     00010534  EB43                             jmp L00010579
     00010536                           L00010536:
     00010536  8D4584                           lea eax,[ebp-7Ch]
     00010539  50                               push    eax
     0001053A  8D8574FFFFFF                     lea eax,[ebp-0000008Ch]
     00010540  50                               push    eax
     00010541  FF15941A0100                     call    [ntoskrnl.exe!RtlInitUnicodeString]
     00010547  8D4580                           lea eax,[ebp-80h]
     0001054A  50                               push    eax
     0001054B  8D857CFFFFFF                     lea eax,[ebp-00000084h]
     00010551  50                               push    eax
     00010552  56                               push    esi
     00010553  8D8574FFFFFF                     lea eax,[ebp-0000008Ch]
     00010559  50                               push    eax
     0001055A  FF15901A0100                     call    [ntoskrnl.exe!IoGetDeviceObjectPointer]
  6. So what magic thing does IoGetDeviceObjectPointer, which is only available in kernel mode, tell you when you call it on \Device\Harddisk0\Partition0 ?

    From an ancient post to

    If you get the pointer to \device\harddisk(n)\partition(n) using IoGetDeviceObjectPointer(), you will get a pointer to the partitions device object. If you want the physical disk device object, you need to get the pointer to \device\harddisk(n)\partition0.

    So partition0 lets us get to the physical disk

    And that gives us a lot of performance metrics and counters that are below the logical level for the disk.

  7. Finally, trying to find a time that I thought it might actually be using the driver. I ran a "surface test" from EaseUS, and I see stats on the performance. They could be doing that from user level, but in Process Explorer, when I took a snapshot, I suddenly saw the dll active: presumably the part of the system that talks to the driver.

Still not sure if that's a good answer to the question. But it was fun exploring, anyway! Thanks for reading.

share|improve this answer
Indeed, there are functions available in kernel mode which are not available in user mode as functions (take IoCreateDisk for instance), but there are (semi-?)equivalents to many of them (e.g. IOCTL_DISK_CREATE_DISK, or the user-mode perf counters, etc.). The fact that some programs don't seem to need a kernel driver (or at least not nearly as much) makes me wonder why other programs do. But +1, this is awesome! – Mehrdad May 13 '12 at 9:48

They need to intercept all disk accesses. For example, suppose you're in the process of cloning a partition. If any writes are made to the disk during the cloning process, the sector written to must be cloned prior to permitting the write to go through, otherwise the resulting clone will be inconsistent.

share|improve this answer
Doesn't Windows already have volume snapshots/shadow copies precisely for this purpose? (E.g. this functionality.) After all, programs like Disk2VHD certainly don't seem to need this, and yet they certainly need to block writes... – Mehrdad May 13 '12 at 6:07
Disk2VHD doesn't try to change a partition while Windows is using it like partition managers do. Disk2VHD doesn't try to present a virtual partition to Windows during its operations. – David Schwartz May 13 '12 at 7:43
It still has to block writes though, doesn't it? – Mehrdad May 13 '12 at 7:47
Also, no program (or at least, no sane program...) changes a partition while Windows is using it. (This is enforced in Windows Vista/7, but it's true in every version past XP.) Furthermore, no [sane] partition manager tries to present a virtual partition to Windows while it proceeds with changing a partition. Partition managers just lock the partition when they can, and reboot into native mode when they can't. – Mehrdad May 13 '12 at 7:57
That is not true. Acronis Backup and Restore, for example, can boot from a partition while it's restoring it. – David Schwartz May 13 '12 at 8:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.