Looking for some advice. I have a filter that creates a zero byte file on a volume. The contents of the file is virtual. When a read or write request come through, I read and write the data somewhere else, not the physical file itself. When I respond to size queries, I can set the allocation size, and the end of file size. After doing some reading, I see that offline files will report zero as allocation size, but will report the actual file contents size for end of file. In my case, the file occupies no disk space, so I am inclined to return zero for the allocation size. When I do this everything looks good in the file manager. File properties show the size properly, and shows zero bytes on the disk. However, some tools see the file as zero bytes. HxD (hex editor) for example does not let me browse the file as it shows it as zero bytes. I guess HxD is reading the allocation size and not the EOF. If I set allocation size to the EOF, then the tools work properly. If I attach the virtual VHD file in disk manager, it works just fine with allocation size set to zero. So far, it only appears to be an anomaly with some tools.
I am asking should I continue to use zero to be more correct, or should I set them both to the EOF to ensure tools like HxD will work properly; correct for anomalies? What are your experiences?
It looks like you're new here. If you want to get involved, click one of these buttons!
|Upcoming OSR Seminars||Kernel Debugging||30 Mar 2020||OSR Seminar Space|
|Writing WDF Drivers||13 April 2020||OSR Seminar Space & ONLINE|
|Developing Minifilters||20 Apr 2020||OSR Seminar Space & ONLINE|
|Internals & Software Drivers||TBD||Dulles, VA|