minivers

A Windows minifilter driver that snapshots files with chosen extensions before they change, get renamed, or get deleted, with ransomware protection raised as an untested use case.

Minivers is a Windows file system minifilter driver that monitors changes to files with certain extensions, written in C. When a monitored file is about to be changed, deleted, or renamed, it performs a backup copy before the operation begins. The driver sits at the file system level, intercepting operations early enough to snapshot the file first.

A side effect is stated plainly: files with the monitored extension cannot be deleted. That restriction is intentional, and the README says it can be changed by editing a define in the source. Behavior like this is controlled at build time rather than through configuration, which keeps the driver small at the cost of flexibility.

The README suggests Minivers could protect against ransomware, since ransomware tends to search for files with certain extensions, and the backup-on-change mechanism is what would make that work. It is careful to mark this as not tested, which sets expectations better than most hobby drivers do.

Minivers also logs the name of the executable that produced each change, and that logging can be turned off with another define in the source. Between the deletion restriction and the logging toggle, the whole behavior surface fits in a handful of source-level switches, which suits a driver of this size.

The driver trades simplicity for bluntness: monitored files are protected from deletion, the changing executable gets logged, and both behaviors are toggled by defines in the source.

• Source 1 · Project repository
• Source 2 · README