# Windows File Path

Key: `technology.filesystem.windows_path`

An absolute Microsoft Windows filesystem path: a drive letter and colon (C:\\, D:\\) or a UNC share root (\\\\server\\share) followed by backslash-separated segments. Distinct from URLs (no scheme) and POSIX paths (forward-slash rooted).

Page: <https://meridian.online/docs/projects/finetype/types/technology/filesystem/windows_path>

Samples: `C:\Windows\System32\drivers\WdfLdr.sys`, `D:\research\repos\project\src\Main.cs`, `\\server\share\reports\q3.xlsx`

## Background

### Origin

Microsoft's Win32 documentation defines a path as one or more components separated by a backslash, each component usually being a directory name or file name.[[1]](https://learn.microsoft.com/en-us/windows/win32/fileio/naming-a-file) The .NET documentation describes a standard DOS path as a volume or drive letter followed by the volume separator (:), a directory name, and an optional filename.[[2]](https://learn.microsoft.com/en-us/dotnet/standard/io/file-path-formats) UNC paths are used to access network resources and begin with a server or host name prefaced by two backslashes, followed by a share name.[[2]](https://learn.microsoft.com/en-us/dotnet/standard/io/file-path-formats)

### Use

Microsoft's monitoring advice for event 4688 suggests checking whether the process name is outside a standard folder such as System32 or Program Files.[[3]](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688) Sysmon's image filter condition matches an image path by full path or by image name alone, so that lsass.exe matches c:\\windows\\system32\\lsass.exe.[[4]](https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon)

Microsoft advises not to assume case sensitivity in Windows names, treating OSCAR, Oscar and oscar as the same name.[[1]](https://learn.microsoft.com/en-us/windows/win32/fileio/naming-a-file) Microsoft's naming rules state that drive letters are case-insensitive, so D:\\ and d:\\ refer to the same volume.[[1]](https://learn.microsoft.com/en-us/windows/win32/fileio/naming-a-file) Compare and deduplicate Windows paths case-insensitively, or two spellings of one file will count as two files. (Meridian's view) During Windows path normalisation, all forward slashes are converted into the standard Windows separator, the backslash.[[2]](https://learn.microsoft.com/en-us/dotnet/standard/io/file-path-formats)

A path such as C:Projects\\file.sln, with a drive letter but no backslash after the colon, is relative to the current directory of that drive rather than to its root.[[2]](https://learn.microsoft.com/en-us/dotnet/standard/io/file-path-formats) The .NET documentation calls such drive-relative paths a common source of program and script logic errors.[[2]](https://learn.microsoft.com/en-us/dotnet/standard/io/file-path-formats) Microsoft's documentation explains that a \\\\?\\ prefix tells the Windows APIs to disable string parsing and pass the path straight to the file system.[[1]](https://learn.microsoft.com/en-us/windows/win32/fileio/naming-a-file) In editions of Windows before Windows 10 version 1607, the maximum path length is MAX\_PATH, defined as 260 characters.[[1]](https://learn.microsoft.com/en-us/windows/win32/fileio/naming-a-file) In pathlib, a UNC share such as //host/share is treated as the drive of a PureWindowsPath.[[5]](https://docs.python.org/3/library/pathlib.html) Parsing with a library built for Windows paths is safer than splitting on backslashes by hand, since UNC roots, device prefixes and mixed separators all trip up a naive split. (Meridian's view)

## Sources

1. [Naming Files, Paths, and Namespaces - Win32 apps](https://learn.microsoft.com/en-us/windows/win32/fileio/naming-a-file) — documentation
2. [File path formats on Windows systems - .NET](https://learn.microsoft.com/en-us/dotnet/standard/io/file-path-formats) — documentation
3. [4688(S) A new process has been created. - Windows 10](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688) — documentation
4. [Sysmon - Sysinternals](https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon) — documentation
5. [pathlib — Object-oriented filesystem paths](https://docs.python.org/3/library/pathlib.html) — documentation