How does it work?

[Tom]

I've read quite a lot about virtualization and such, and I now know quite a few methods.
For example using file system filter drivers or api call interception.
What does SandBoxIE use? (yeah I read the page on how it works)

[tzuk]

API call interception in kernel mode. The core of Sandboxie is a device driver.

[Guest]

Does the kernel interception also protect the Windows Registry?

[mizzmona]

Yes.