MSDN says that an Alternate Data Stream has its own attributes (encrypted, compressed, etc.) that are separate from the file to which they are attached. I have not found information concerning the relationship between the timestamps on a file and attached streams. In other words, do streams have their own timestamps that are separate from the file to which they are attached? I am talking about the following timestamps:
I do not have code for stream attribute handy with me, but IIRC its the file name attribute in NTFS MFT which stores, Create modify & last access time.
So I’ll doubt if the same information is part of data stream attribute as well. I’ll update here in case I notice something different in the structure.
Thank you for responding to my question! I didn’t think to look at the MFT… The Standard Information part of an entry in the MFT contains the following, just as you’ve said:
For standard Information, record type 0x10 the following fields are displayed
Creation date
File modified date
MFT changed time
File read time
File sttribute, such as Read Only, Compressed, Hidden
So, if streams have independent entries in the MFT, then they would have their own timestamps and attributes. I am not an MFT expert, but I would expect that each stream would have its own entry in the MFT… Do you agree?
So, I wrote a little routine to dump the timestamps from a file that has some alternate data streams attached to it. I edited one of the streams and saved the changes. Here is a dump of the timestamps for the file and the stream… It looks like the stream’s timestamps are the same as the file’s timestamps, so I wonder whether this means that streams use the file’s timestamps. Arggg… Confusion!
>>I wonder whether this means that streams use the file’s timestamps.
Yes, from the disk structure it is clear that this is exactly the case. data attribute which means data for a stream simply points to data and have no metadata attached (Name is in header). Which means that all streams uses the same information stored in a common attribute.
Streams are simply data attribute (be it named or unnamed), no other
characteristics.
So they share other metadata information with the container file.
I am not sure if it belonged to ntfsd but for sure didn’t belong to ntdev.
-Deepak
On Sat, Feb 19, 2011 at 8:05 AM, wrote:
> >>I wonder whether this means that streams use the file’s timestamps. > > Yes, from the disk structure it is clear that this is exactly the case. > data attribute which means data for a stream simply points to data and have > no metadata attached (Name is in header). Which means that all streams uses > the same information stored in a common attribute. > > — > NTDEV is sponsored by OSR > > For our schedule of WDF, WDM, debugging and other seminars visit: > http://www.osr.com/seminars > > To unsubscribe, visit the List Server section of OSR Online at > http://www.osronline.com/page.cfm?name=ListServer >
It affirms what Deepak said about timestamps, and it specifically says what information is available, which my little test code confirmed (except, of course, the timestamps must go away from my code!).
Thank you for your comments!
Mike
P.S. I posted in this forum because we are working on a software only, kmdf, functional driver and not a filter driver.
Each stream that is associated with a file has its own allocation size, actual size, and valid data length:
?The allocation size is the amount of disk space that is reserved for a stream.
?The actual size is the number of bytes that are being used by a caller.
?The valid data length (VDL) is the number of bytes that are initialized from the allocation size for the stream.
Each stream also maintains its own state for compression, encryption, and sparseness. The sparse attribute on the file is set if any of the streams have ever been sparse.
There are no file times associated with a stream. The file times for a file are updated when any stream in a file is updated.
Opportunistic locks are maintained per stream.
Sharing modes are also maintained per stream.
