Detecting File Archive flag change

NTFSD
1

Hi all,

I am tracking file metadata changes by looking for desiredAccess flag
FILE_WRITE_ATTRIBUTES & SYNCHRONIZE

This works fine except I want to ignore when the Archive bit is cleared.
When I do this operation from Windows Explorer, I never see
FILE_ATTRIBUTE_ARCHIVE (and I guess I shouldn’t). But is there a way of
detecting that this particualr has been cleared?

Thanks, bjorn

2

Bjorn

You can query the file attributes in FileBasicInformation of course. However
you really should have a scan of fastfat to see how the archive bit changes
“underneath your feet” :slight_smile:

Cheers
Lyndon

“bjorn haake” wrote in message news:xxxxx@ntfsd…
> Hi all,
>
> I am tracking file metadata changes by looking for desiredAccess flag
> FILE_WRITE_ATTRIBUTES & SYNCHRONIZE
>
> This works fine except I want to ignore when the Archive bit is cleared.
> When I do this operation from Windows Explorer, I never see
> FILE_ATTRIBUTE_ARCHIVE (and I guess I shouldn’t). But is there a way of
> detecting that this particualr has been cleared?
>
> Thanks, bjorn
>
>
>

3

Thanks! This seems to mostly work and I can even distinguish between setting
and unsetting the flag. One quirk I noticed: It always works for setting the
flag. When the dialog stays open clearing it doesn’t always seem to work
(after an initial "Apply: for subsequent operations).
If I just click “Apply” I don’t see the archive bit set anymore after the
third apply, e.g. I open the dialog, clear the flag, hit apply, set the
dialog, click apply then clear it again and hit apply - in the later case
even hitting OK will not show the archive bit being set…

But then again, maybe that’s why you wrote that second sentence :slight_smile:

bjorn

“Lyndon J Clarke” wrote in message
news:xxxxx@ntfsd…
> Bjorn
>
> You can query the file attributes in FileBasicInformation of course.
> However you really should have a scan of fastfat to see how the archive
> bit changes “underneath your feet” :slight_smile:
>
> Cheers
> Lyndon
>
> “bjorn haake” wrote in message news:xxxxx@ntfsd…
>> Hi all,
>>
>> I am tracking file metadata changes by looking for desiredAccess flag
>> FILE_WRITE_ATTRIBUTES & SYNCHRONIZE
>>
>> This works fine except I want to ignore when the Archive bit is cleared.
>> When I do this operation from Windows Explorer, I never see
>> FILE_ATTRIBUTE_ARCHIVE (and I guess I shouldn’t). But is there a way of
>> detecting that this particualr has been cleared?
>>
>> Thanks, bjorn
>>
>>
>>
>
>
>