Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.More Info on Driver Writing and Debugging
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
Does NTFS fill zero automatically when extending a file?
As i know there are 4 ways to extend a file:
1. NtSetInformationFile(EndOfFileInformation...)
2. NtCreateSection with a size larger than the current file size
3. NtMapViewOfSection(MEM_RESERVE) followed by NtAllocateVirtualMemory(MEM_COMMIT)
4. NtWriteFile with offset larger than file size
Does NTFS fill extended part with zero for all 4 cases? Is there any other way to extend a file?
Howdy, Stranger!
| Upcoming OSR Seminars | ||
|---|---|---|
| OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead! | ||
| Internals & Software Drivers | 7 February 2022 | Live, Online |
| Kernel Debugging | 21 March 2022 | Live, Online |
| Developing Minifilters | 23 May 2022 | Live, Online |
| Writing WDF Drivers | 12 September 2022 | Live, Online |
Comments
It’s the file system’s job to make sure that a read beyond the VirtualDataLength (like a write high water mark) come back as zero. And it’s really hard to do.
Most file systems will implement ‘read as zero beyond VDL’ and zero on disk when the file is closed. NTFS actually persists the VDL. And ISTR that REFS goes one further and tracks all areas that have never been written to and reads them as zero.
These all being tricks to avoid writing if you don’t have to. Previous generation file systems (the XQP springs to mind) did an explicit zero on extend of allocated area.
There is an ECP which causes a file to be extended (I.e. the eof, not just the allocation) but I’m away from my desk at the moment so I don’t have it to hand. It is documented.
thanks rod, very helpful