Mountee is a small menu bar app plus an FSKit file system extension. There is no kernel extension and no FUSE driver. This page explains the path from Finder to an NTFS volume.

The layers

Finder and applications
        │
        ▼
macOS FSKit  ──────────────  user space
        │
        ▼
NTFSModule.appex
  ├─ NTFSVolumeV3 (macOS 27+)
  ├─ NTFSVolumeV1 (macOS 26)
  ├─ device shim (aligned read-modify-write)
  └─ ntfs_bridge.c
        │
        ▼
libntfs-3g.a  (pinned, statically linked)
        │
        ▼
NTFS block device

The app

The SwiftUI menu bar app discovers volumes with Disk Arbitration, lists them, and calls the mount service. It also handles per-user extension enablement and diagnostics. The app is non-sandboxed because it needs to talk to the file system extension machinery; the extension itself is sandboxed.

The FSKit extension

NTFSModule.appex is the file system module macOS loads. It probes the NTFS boot sector and implements volume operations. There are two adapters:

NTFSVolumeV3 uses the async FSVolume.Handler API on macOS 27 and later.
NTFSVolumeV1 uses the older FSVolume.Operations API on macOS 26. It is deprecated in macOS 27 but is the only volume API available on 26.

The deployment target is macOS 26.0, so newer APIs cannot slip in accidentally.

The bridge and engine

bridge/ntfs_bridge.c owns one ntfs_volume and serializes calls on the extension’s queue. It maps operations to POSIX errors, enforces the safety gates, and protects NTFS metadata files. The bridge links libntfs-3g.a directly; no FUSE code is compiled or linked.

Device I/O uses the resource’s direct path, bypassing the kernel buffer cache. Unaligned requests are wrapped in sector-aligned read-modify-write operations.

Mount paths

Mountee normally uses Disk Arbitration for discovery, mount, unmount, and eject. On macOS 27, Disk Arbitration’s mount path refuses third-party FSKit modules (status 49244 / ENOPROTOOPT), so the app falls back to the validated mount -F path. Listing, unmount, and eject still use Disk Arbitration.

Why user space matters

Traditional NTFS drivers on macOS often ship a kernel extension or depend on macFUSE. Kernel code runs with high privileges, can break with OS updates, and may require lowering macOS security settings.

Mountee keeps the filesystem work in user space through FSKit. The trade-off is narrower platform support: macOS 26+ on Apple Silicon. That is a deliberate constraint, not an accident.

Safety in the write path

Read-only is the default.
Dirty or hibernated volumes are refused for read/write.
Unsupported operations return ENOTSUP.
Metadata files cannot be unlinked.
Format, repair, and erase are not implemented.

The write path was validated with content hashes across remounts on disposable images. It has not been fault-injection tested for crash consistency.

Architecture