Ext4 for Windows - Release 10.2026

Native ext2, ext3 and ext4 read/write file-system driver for Windows 10 and Windows 11 x64.

Code pages and case folding, rebuilt under MIT

• The 37 code page converters are generated from the published Microsoft, ISO 8859 and KOI8 mapping tables, with every difference the driver has always had kept as listed data. They are stored as 32-entry slices; the GBK and UHC extensions, which fill in Unicode order the code points their base sets leave free, are a population count on the Unicode side and the position of a set bit on the code side - no search. The CJK tables went from 277 KB to 201 KB; 18 KB of case maps the driver never read are gone.
• KOI8-RU read every byte but the two it changes as Ў or ў; it now reads as KOI8-U except for those two. The Shift JIS encoder no longer writes a Latin-1 character's two bytes past a one-byte bound.
• Casefolded directories fold names through tables generated from the Unicode Character Database 12.1 and a normalizer written anew from what Linux emits, including for invalid UTF-8, which Linux hashes too. Every one of the 1 112 064 code points has the leaf of Linux's trie; a name folds about 2.5 times faster. Strict mode refuses what Linux's utf8nlen() refuses: the previous check accepted stray continuation bytes.
• Both are MIT-licensed new work; the driver as a whole remains GPL-2.0.
• 3 500 lines of declarations nothing used are removed. ext4.sys is 598 KB, from 819 KB in the previous release.

Compact character mappings and name lifetime

• A failed filename conversion no longer returns a freed directory entry. Allocation and conversion failures release the entry once; the caller receives NULL.

Corruption handled as Linux handles it

• Every metadata checksum is verified before use: superblock, group descriptors, block and inode bitmaps, inodes, extent nodes, directory leaves and htree nodes, xattr blocks, MMP and the journal.
• Corruption found on disk is recorded in the superblock the way ext4_error records it - the error flag, the count, the first and the last place found - and the volume goes on or stops writing as its errors= setting asks. The record is written by a per-volume worker, never from inside paging I/O.
• A group whose bitmap fails its check is left out of allocation. An inode whose blocks cannot all be released goes on the orphan list. A file whose inode cannot be read is listed by name and fails to open.
• A superblock that fails its own checksum, which Linux refuses to mount, is mounted read-only and never written: the files can be copied off, and Windows does not offer to format the partition.

Security and correctness

• Volume lock, unlock, dismount and extended DASD I/O are taken from volume handles only; through a file handle any user could lock or dismount a volume.
• Reparse point, EA and mounted-volume requests refuse the control device and volume handles before their context is used. Setting and deleting a reparse point checks what NTFS checks and what Linux checks (mode bits, chattr +i/+a).
• Set-information buffers are checked against each class's fixed size and a rename's or link's whole name, also for requests other drivers build.
• A Linux fast symlink followed from Windows no longer has its / separators turned into \ in the inode itself; a symlinked directory lists the directory it points to.
• Paths are built from the name tree when asked: an open file's path follows a renamed parent, and a directory watch survives the rename of its directory.
• Copied folders stay writable: a folder's read-only attribute is no longer taken for a permission, and attributes set right after a create keep the directory bit.
• HidingPrefix / HidingSuffix reach the volumes; a drive letter requested through IOCTL_APP_MOUNT_POINT is created on the letter asked for.
• A removed directory's blocks are freed with lookups kept off, so a racing lookup no longer records corruption on a sound volume.

Waiting on events, not on time

• Requests sent to the disk are waited for until they complete, as NTFS and FAT wait; a 30-second cancel used to report a write that completed as failed.
• The journal polls no more. Handles, commits and the stop wait for events set under the journal lock; the journal thread wakes at the commit interval - counted from a transaction's first record, as jbd2 counts it - at the idle checkpoint, or on a request. A commit used to abort the journal after 30 seconds of waiting for handles, which could turn a volume on a slow disk read-only.

Code

• The large dispatch routines run as short steps over explicit request state; driver load and unload are one step per resource, each undone by its counterpart.
• Builds are reproducible: the same source and toolset give the same ext4.sys and ext4ctl.exe byte for byte. The final Release image was rebuilt and compared before packaging.

Validation

The packaged image passed the full Windows/Linux matrix under Driver Verifier: 20 sections, including folder copies, parallel I/O, stop/load cycles, hot-plug, LUKS/LVM, Linux feature checks with casefolded directories, clean e2fsck and content verification. The code page converters passed 25,510,794 equivalence checks on each of x86 and x64 against the converters they replace, and 38 code pages passed a Windows filename test with 1206 names and unrepresentable-name rejection. Case folding passed 4,501,783,352 checks against the Linux trie. All host models pass; Release and Debug builds pass /W4 /WX without warnings, and the Release image rebuilt from the published source is identical byte for byte.

The 11 October build passed the 219 e2fsprogs malformed-media fixtures, planted-corruption checks and dedicated ext2/ext3 media checks; those campaigns were not repeated for the table and converter changes.

Limits

Damage found on disk is refused, recorded and contained, never repaired: that remains e2fsck's work. Orphans a Linux crash left behind are not processed at mount. A volume with an external journal is mounted read-only. Keep backups of important data.

Package and loading

ext4.7z contains ext4.sys and ext4ctl.exe, without a password. Microsoft production signing is pending; use KVC or DrvLoader on a machine you administer.

copy /y ext4.sys "%SystemRoot%\System32\drivers\ext4.sys"
kvc driver load ext4
sc query ext4

Before replacing the image, run sc stop ext4 and wait for STOPPED. Copy the replacement and load it again. The README documents kvc driver reload ext4, DrvLoader and the separate kvc install ext4 boot-loader path.

• README and source
• Technical project page
• KVC
• KernelResearchKit
• Demonstration