Does NTFS fill zero automatically when extending a file?

NTFSD
1

As i know there are 4 ways to extend a file:

  1. NtSetInformationFile(EndOfFileInformation…)
  2. NtCreateSection with a size larger than the current file size
  3. NtMapViewOfSection(MEM_RESERVE) followed by NtAllocateVirtualMemory(MEM_COMMIT)
  4. NtWriteFile with offset larger than file size

Does NTFS fill extended part with zero for all 4 cases? Is there any other way to extend a file?

2

It’s the file system’s job to make sure that a read beyond the VirtualDataLength (like a write high water mark) come back as zero. And it’s really hard to do.

Most file systems will implement ‘read as zero beyond VDL’ and zero on disk when the file is closed. NTFS actually persists the VDL. And ISTR that REFS goes one further and tracks all areas that have never been written to and reads them as zero.

These all being tricks to avoid writing if you don’t have to. Previous generation file systems (the XQP springs to mind) did an explicit zero on extend of allocated area.

There is an ECP which causes a file to be extended (I.e. the eof, not just the allocation) but I’m away from my desk at the moment so I don’t have it to hand. It is documented.

3

thanks rod, very helpful