Re: Re: [ntfsd] file_overwrite deletes ads

Hi Ged,

There are other fun things you could do. For example, if you rename the
main stream to an ADS it’s similar to a FILE_OVERWRITE on the main stream
(open the file and send a FileRenameInformation with just “:foo” and the
main stream will become an ADS). So you could do something like this:

  1. if you see FILE_OVERWRITE, open file and rename main stream to something
    like “:old_main” and then close the file.
  2. replace FILE_OVERWRITE with FILE_OPEN
  3. continue the create.

Then, in postCreate, you can decide if you want to keep the “old_main”
stream or get rid of it altogether. The main advantage of this is that you
won’t have to move GBs of data around from one file to the other…

Thanks,
Alex.

On Tue, Jun 3, 2014 at 2:55 PM, Marion Bond wrote:

> How often do you expect this operation in real life? If the file IO is
> from your application, I would expect it not to do this without a good
> reason. And if the file IO is from another application (ie a restore by a
> backup application), then maybe regenerating multiple GB of data isn’t such
> a bad thing
>
> Sent from Surface Pro
>
> From: Ged Murphy
> Sent: ‎Tuesday‎, ‎June‎ ‎03‎, ‎2014 ‎5‎:‎44‎ ‎PM
> To: Windows File Systems Devs Interest List
>
> That’s disheartening, as the whole product of which the driver is part of
> is heavily reliant on the concept of there being two streams of data, the
> primary stream and an alternative ‘managed’ stream.
>
> I previously stated that this managed stream can contain a copy of the
> primary stream, but depending on configuration this ADS could contain copy
> of the original data, it could be an encrypted or compressed version of the
> original data, or it may contain totally different data. While they are
> certainly the same file by design but with different views depending on
> configuration, they need to be thought of as separate files in terms of
> deletion.
>
> If I do have to go with removing the flag and implementing the
> functionality of FILE_OVERWRITE in my post-create, does anyone have any
> suggestions of things I should ensure happen? Would it be safe to just
> empty the file and reset the attributes (as per the FastFat driver), or is
> anyone aware of the NTFD FSD doing something more?
> This feels dirty….
>
>
> Interestingly, Tony stated that if the ADS is opened at the time the
> FILE_OVERWRITE flag is used, it will remain until that stream is closed.
> Perhaps opening the ADS before forwarding to the FSD will create an
> opportunity to stop the data from being deleted (maybe sending an
> FILE_DISPOSITION_INFORMATION with false could reverse that). I’m not sat at
> my dev machine at the moment to check this, I’m just thinking aloud.
>
> Thanks for your responses guys.
> Ged.
>
>
>
>
> On 03/06/2014 21:17, “Alex Carp” wrote:
>
> I spent some time struggling with this too, eventually I changed my design
> a little to deal with my ADS being removed. I couldn’t find a way to keep
> the ADS short of removing the FILE_OVERWRITE and truncating the file in
> postCreate.
>
> However, it really depends how you think about the ADS. For example, if
> the ADS contains some information about the data in the file (like for the
> Zone Identifier) then you can safely remove the ADS on FILE_OVERWRITE
> because all the file contents are gone. Also, from reading your comment, if
> your ADS is a copy of the primary stream, perhaps it should go away when
> all the data in the primary stream goes away? Or at least you could check
> in preCreate whether there was an ADS and then in postCreate, after
> FILE_OVERWRITE you would create a new, empty ADS (which is technically a
> copy of new data in the file)…
>
> Thanks,
> Alex.
>
>
>
> —
> NTFSD is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
> —
> NTFSD is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>