A disk-based write filter can include a filter driver that is loaded below the file system driver to thereby provide write filter functionality at the disk level, and a supporting driver that is loaded above the file system driver. When an excluded file is opened, the supporting driver can obtain the file's disk sector information and provide it to the filter driver to cause the filter driver to pass through I/O requests that target sectors defined in the file's disk sector information. When the excluded file is closed, the supporting driver can again obtain the file's disk sector information and provide it to the filter driver to allow the filter driver to identify any additional sectors that may have been allocated to the file. The filter driver can copy any such sectors from an overlay to disk and commence passing through I/O requests that target these sectors.