Difference between a stream context and a file context

NTFSD
1

What’s the difference between a stream context and a file context, in
relation to FltSetStreamContext and FltSetFileContext (and even
FltSetStreamHandleContext)?

or perhaps, how do file, stream and stream handle relate (or differ)?

the ctx minifilter example uses them all but doesn’t make clear how they
differ.

Thanks

Sam

2

Hello Sam,

This is a good article that explains some things from a file system perspective (http://msdn.microsoft.com/en-us/library/ms790773.aspx or search for “File Streams, Stream Contexts, and Per-Stream Contexts”).

StreamHandle context -> per FileObject. Each FileObject gets a different context.

Stream context -> all the file objects that refer to the same stream (FsContext is the same) get the same stream.

File context -> all the fileobjects for all the streams for the same file get the same context.

Regards,
Alex.
This posting is provided “AS IS” with no warranties, and confers no rights.

3

* Alexandru Carp wrote, On 11/09/09 16:48:

Hello Sam,

This is a good article that explains some things from a file system perspective (http://msdn.microsoft.com/en-us/library/ms790773.aspx or search for “File Streams, Stream Contexts, and Per-Stream Contexts”).

StreamHandle context -> per FileObject. Each FileObject gets a different context.

Stream context -> all the file objects that refer to the same stream (FsContext is the same) get the same stream.

File context -> all the fileobjects for all the streams for the same file get the same context.

Thanks Alexandru; I hope you don’t mind if I try to recite this back to
you so that you can check if I got it right:

File Context: Shared between all streams of an already-opened file,
(regardless of credentials for local file systems, and per-session for
network file systems). If all streams of the file (or within the session
for network file systems) are closed, then the context is lost.

Stream Context: Share between a specific stream of an already opened
stream (regardless of credentials for local file systems, per session
for network file systems) and lost when all instances of the stream are
closed.

StreamHandle context: Not shared, in normal cases will be unique to the
user-space file-handle.

Sam

4

That sounds right.

You can keep extra references to the contexts to prevent them from getting freed however doing so will just keep the memory allocated but the structures will no longer be attached to the underlying object.

Regards,
Alex.
This posting is provided “AS IS” with no warranties, and confers no rights.