Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

Does NTFS fill zero automatically when extending a file?

HaiboHaibo Member Posts: 187
edited September 10 in NTFSD

As i know there are 4 ways to extend a file:
1. NtSetInformationFile(EndOfFileInformation...)
2. NtCreateSection with a size larger than the current file size
3. NtMapViewOfSection(MEM_RESERVE) followed by NtAllocateVirtualMemory(MEM_COMMIT)
4. NtWriteFile with offset larger than file size

Does NTFS fill extended part with zero for all 4 cases? Is there any other way to extend a file?

Post edited by Haibo on

Comments

  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,210

    It’s the file system’s job to make sure that a read beyond the VirtualDataLength (like a write high water mark) come back as zero. And it’s really hard to do.

    Most file systems will implement ‘read as zero beyond VDL’ and zero on disk when the file is closed. NTFS actually persists the VDL. And ISTR that REFS goes one further and tracks all areas that have never been written to and reads them as zero.

    These all being tricks to avoid writing if you don’t have to. Previous generation file systems (the XQP springs to mind) did an explicit zero on extend of allocated area.

    There is an ECP which causes a file to be extended (I.e. the eof, not just the allocation) but I’m away from my desk at the moment so I don’t have it to hand. It is documented.

  • HaiboHaibo Member Posts: 187

    thanks rod, very helpful

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Internals & Software Drivers 15 November 2021 Live, Online
Writing WDF Drivers TBD Live, Online
Developing Minifilters 7 February 2022 Live, Online
Kernel Debugging 21 March 2022 Live, Online