I/O request data for user-mode programs is recorded into a log, which later allows the I/O requests to be replayed. By substantially exact replay, tests are performed with different versions/combinations of kernel components using the same I/Os as when recorded. A user-mode record/replay program and kernel-mode filter driver record a program's I/O requests, such as data I/O request packet (IRP) data received by the filter driver. While recording, tests exclude IRPs not directly resulting from program requests. Recorded I/O request data is maintained in log file records. At replay time, the records are read and corresponding I/O requests sent towards the storage volume as if requested by the original program. Tables are maintained for information relevant to the replay context, such as file handles, file IDs, and short names that vary from the record context. Substitution from the tables allows I/O requests to be replayed as originally issued.