While these fields in the FSRTL Advanced header are updated by the
underlying FS, there are no guarantees when these fields are going to be
updated. Within NTFS, there are several situations where these fields
are not updated when you would expect them to be, particularly with
transactional requests.
Pete
–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295
------ Original Message ------
From: xxxxx@gmail.com
To: “Windows File Systems Devs Interest List”
Sent: 10/11/2016 10:04:20 AM
Subject: RE:[ntfsd] Write Through Paging Write past EOF
>Hi Rod,
>
>No, this is not a MFT resident file. EOF (FCB->FileSize) gets updated
>to the correct value at the end of the cache write.
>
>The FAT and NTFS call stacks are exactly the same, CcFlushCache
>initiated by CcCopyWriteEx.
>
>The difference in behaviour is FAT updates FileSize before calling
>CcCopyWriteEx, whereas NTFS does not.
>
>I thought that FCB->FileSize was what all file systems use to track
>EOF, but it seems I cannot make that assumption anymore.
>
>thanks
>aaron
>
>
>—
>NTFSD is sponsored by OSR
>
>
>MONTHLY seminars on crash dump analysis, WDF, Windows internals and
>software drivers!
>Details at http:
>
>To unsubscribe, visit the List Server section of OSR Online at
>http:</http:></http:>