ADS, SummaryInformation etc.

NTFSD
1

Hi,
I was fiddling with FileMon trying to see where the Summary Information
associated with a file is stored. I figured it is in a ADS called
file:(unprintablechar)SummaryInformation. However, there is something which
i find puzzling. If I add summary information to a file for which it doesn’t
exist yet I see two CREATE’s.
Say the file is called e:\fiddle\foo.c I see two creates:

  1. e:\fiddle\foo.c:(x)SummaryInformation:$DATA
  2. e:\fiddle\foo.c:(x)SummaryInformation:$DATA
    Now while 2 seems fine, I find 1 weird. What is happening? Why do I see a \
    after the file name?
    Pardon me for my ignorance :slight_smile:
    Thanks