Zero-Driver Virtual File System (VFS), Host Storage Isolation, and Zero-Risk Express Onboarding

A Technical and Security Specification for Kernel-Crash-Proof Virtual Drive Provisioning, Localhost Streaming Cryptography, and Host OS Protection

┌──────────────────────────────────────────────────────────────────────────────────────────────────┐
│                                    EXECUTIVE APEX SUMMARY                                        │
│ • ARCHITECTURE: Microsoft Native WebDAV Mini-Redirector (MRxDAV.sys) on Localhost Loopback       │
│ • STABILITY POSTURE: 0.0% BSOD Risk, Zero Third-Party Kernel Drivers (No WinFsp, Dokany, CBFS)   │
│ • HOST SAFETY: 100% Non-Destructive, Zero Disk Re-Partitioning, C:\ OS & Existing Files Untouched│
│ • CRYPTOGRAPHIC LIFECYCLE: In-Memory 64KB AES-256-GCM Streaming, Volatile RAM Key Zeroization    │
│ • MOUNT EPHEMERALITY: User-Space Loopback Mount with /persistent:no (Clean Reboot Dismount)      │
│ • ONBOARDING PROFILE: 30-Second Zero-Pain OOBE with Air-Gapped Localhost Data Sovereignty        │
└──────────────────────────────────────────────────────────────────────────────────────────────────┘

Section 1: The Virtual Drive Dilemma & Industry Problem Statement

When enterprise administrators, forensic analysts, or privacy-conscious end users first launch a sovereign storage system, encountering an "Express Setup" wizard that offers to create an "Encrypted Drive" triggers immediate and justified operational caution.

In legacy storage architectures, creating an encrypted drive frequently introduces three catastrophic failure modes:

1. Kernel Driver Instability (Ring-0 BSOD Vulnerability): Third-party virtual filesystem frameworks (WinFsp, Dokany, CBFS) install unsigned or third-party kernel-mode .sys drivers. Memory management bugs or conflicts with Windows updates frequently cause catastrophic Blue Screen of Death (BSOD) kernel panics.
2. Whole-Disk Partitioning & BitLocker In-Place Traps: Whole-disk tools (BitLocker, VeraCrypt) operate on physical partitions. Misconfigured format commands can destroy operating system volumes, while TPM key desynchronization can result in permanent data lockouts.
3. Antivirus Quarantines & EDR Conflicts: Corporate EDR systems (CrowdStrike, SentinelOne) aggressively flag third-party filesystem filter drivers as potential rootkits, triggering false positives and interrupted deployments.

TRADITIONAL HAZARDOUS ENCRYPTED DRIVE PARADIGM:
[ Physical Disk C:\ ] ──► In-Place Sector Encryption ──► High Risk to OS & Files
[ Raw Partitioning ]  ──► Destructive Format / MBR    ──► Data Loss Vulnerability
[ Ring 0 Kernel Drv]  ──► Third-Party .sys Filter     ──► Frequent BSOD & Crash Risks

ALASKAVAULT™ ZERO-RISK VIRTUAL LOOPBACK (VFS):
[ Physical Disk C:\ ] ──► Standard Directory (C:\AlaskaVault_PrimaryStore) [100% ISOLATED]
                               ▲
                               │ 64KB AES-256-GCM Streaming in Volatile RAM
                               ▼
[ Memory Loopback ]   ──► http://127.0.0.1:49152/vault (SafeWebDavHandler)
                               ▲
                               │ net use Z: ... /persistent:no (MRxDAV.sys)
                               ▼
[ Windows Explorer ]  ──► Virtual Drive Letter (Z:\) [Ephemeral & Non-Destructive]

Section 2: Zero Third-Party Kernel Drivers (Option A Architecture)

To permanently eliminate driver-induced system instability, AlaskaVault implements its Option A Architecture: leveraging Microsoft's native, signed WebDAV Mini-Redirector driver (MRxDAV.sys).

• Signed Microsoft Component: MRxDAV.sys is built directly into every copy of Windows (Windows 10, Windows 11, Windows Server 2019/2022/2025). It has undergone decades of kernel-level testing by Microsoft.
• Pure Ring-3 User Space Execution: AlaskaVault's streaming engine runs entirely as a standard user process. It does not install kernel filter drivers, does not alter kernel routing tables, and does not require elevated Ring 0 execution privileges.
• 0.0% BSOD Risk Guarantee: Because no custom code executes in kernel mode, it is architecturally and mathematically impossible for AlaskaVault to cause a Windows BugCheck (Blue Screen of Death).

Section 3: Host Storage Isolation & Directory Sandboxing

A common concern for first-time operators is whether mounting an encrypted drive will alter, format, or re-encrypt the computer's existing C:\ partition or personal folders. AlaskaVault enforces strict container isolation:

• Designated Container Sandbox: During Step 1 of Express Setup, the operator designates an isolated repository path (by default C:\AlaskaVault_PrimaryStore, or any custom internal/external path like D:\Vault).
• Strict Directory-Level Boundary: AlaskaVault writes exclusively within this designated directory. All other files and directories on the system—including C:\Windows, C:\Program Files, and user desktop folders—remain completely unreferenced and untouched.
• Standard NTFS ACLs: The repository directory uses standard Windows NTFS Access Control Lists. AlaskaVault executes with standard user privileges, preventing unintended interference with system files.

Section 4: Streaming In-Memory RAM Decryption & Key Zeroization

Unlike legacy archive utilities that extract entire ZIP or RAR containers to temporary folders on physical disk before opening them, AlaskaVault implements an atomic, on-demand streaming lifecycle:

       Write Operation (Explorer -> Z:\)
User File  ──►  64KB Chunk Buffer in RAM  ──►  Argon2id + AES-256-GCM  ──►  Encrypted Blob on Disk

       Read Operation (Z:\ -> Application)
Encrypted Blob  ──►  64KB Chunk Buffer in RAM  ──►  AES-256-GCM Authenticated Decrypt  ──►  Plaintext in Memory

1. 64KB RAM Buffers: When productivity applications (Word, Excel, Photoshop, Notepad) read a file from Z:\, AlaskaVault decrypts only the specific 64KB chunks requested by Windows I/O operations into volatile RAM.
2. Zero Plaintext Disk Residue: No decrypted data is ever written to physical hard drive sectors, swap files, or temporary cache folders.
3. Volatile Key Zeroization: Upon user unmount or app shutdown, all master key derivations and volatile RAM buffers are overwritten with zeros, leaving no readable cryptographic residue.

Section 5: Step-by-Step Risk Deconstruction of Express Setup

The 30-Second Express Onboarding Wizard is structured into three discrete, non-destructive phases:

Section 6: Comparative Security & Stability Matrix

Section 7: Enterprise Compliance & Regulatory Alignment

AlaskaVault's VFS architecture directly satisfies rigorous enterprise security mandates:

• NIST SP 800-88 Rev 1 (Cryptographic Erasure): Immediate volatile key zeroization upon dismount guarantees cryptographic data destruction without requiring physical media shredding.
• CMMC 2.0 / NIST SP 800-171 § 3.13.1 (Boundary Protection): WebDAV endpoints are bound strictly to 127.0.0.1, eliminating external network attack surfaces.
• HIPAA Security Rule § 164.312(a)(2)(iv): In-memory AES-256-GCM authenticated cipher streaming guarantees full cryptographic privacy of ePHI at rest.

Section 8: Operator FAQ

Q1: Will AlaskaVault Express Setup affect existing files on my C:\ drive?

No. AlaskaVault operates exclusively inside its chosen storage folder. It does not scan, modify, or encrypt any existing files, desktop documents, or operating system components.

Q2: Can I choose a location other than C:\?

Yes. During Step 1 of Express Setup, you can specify any local internal drive (such as D:\MyVault) or an external USB storage device.

Q3: What happens when I restart my computer?

Because the virtual drive is mounted with /persistent:no, Windows drops the temporary drive mapping cleanly upon shutdown. No persistent disk hooks or chkdsk errors are ever created.

Q4: Can I skip or exit the setup wizard?

Yes. Clicking the "X" button on the top-right of the Express Setup window closes the onboarding dialog immediately without mounting any drive.

Section 9: Conclusion

AlaskaVault's Safe Native Loopback VFS proves that robust cryptographic privacy does not require risky low-level disk manipulations or unstable kernel-mode drivers. By uniting containerized directory sandboxes, in-memory AES-256-GCM streaming, and Microsoft's native MRxDAV.sys redirector, AlaskaVault delivers total data sovereignty with 100% host OS safety and 0.0% BSOD risk.