Explorer.exe causes spurious reads?

NTFSD
1

*vents*

I don’t suppose anybody could explain why Explorer.exe feels the need to
issue random reads on file when you browse the directories they’re in?
Marking files as offline makes some of them go away, but I do see a read
happening when I right-click and hit ‘Properties’.

Marking the file offline does not make that one go away. I’d really
rather not restore files from the HSM server every time somebody tries
to look at the properties of a file. Does Explorer reliably stop
reading after it has read a certain amount? I can look at this with
Procmon/IrpTracker, but what explorer does today isn’t necessarily what
explorer does tomorrow. I can live with leaving a small stub on disk,
so long as I know what size to make it. Anybody have a recommendation?

~Eric

2

Well, that’s interesting. I was seeing this on a .exe file, but not a
.txt file. Changed the extension, and poof, the read doesn’t happen.
Hmmm.

~Eric

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Eric Diven
Sent: Monday, December 17, 2007 3:39 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Explorer.exe causes spurious reads?

*vents*

I don’t suppose anybody could explain why Explorer.exe feels the need to
issue random reads on file when you browse the directories they’re in?
Marking files as offline makes some of them go away, but I do see a read
happening when I right-click and hit ‘Properties’.

Marking the file offline does not make that one go away. I’d really
rather not restore files from the HSM server every time somebody tries
to look at the properties of a file. Does Explorer reliably stop
reading after it has read a certain amount? I can look at this with
Procmon/IrpTracker, but what explorer does today isn’t necessarily what
explorer does tomorrow. I can live with leaving a small stub on disk,
so long as I know what size to make it. Anybody have a recommendation?

~Eric

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars (including our new
fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Explorer issuing spurious I/O? Surely you jest…

If I were to guess, I’d say it’s probably reading the file’s resource data
so that it can display the icon in the view. If just marking it offline
isn’t working you’re probably up a creek and you’re going to be stuck
applying some kind of elegant heuristic (that of course will have to devolve
over time into a massive series of hacks as you figure out the quirks of
each revision of Explorer).

-scott

Scott Noone
Software Engineer
OSR Open Systems Resources, Inc.
http://www.osronline.com

“Eric Diven” wrote in message news:xxxxx@ntfsd…
Well, that’s interesting. I was seeing this on a .exe file, but not a
.txt file. Changed the extension, and poof, the read doesn’t happen.
Hmmm.

~Eric

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Eric Diven
Sent: Monday, December 17, 2007 3:39 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Explorer.exe causes spurious reads?

vents

I don’t suppose anybody could explain why Explorer.exe feels the need to
issue random reads on file when you browse the directories they’re in?
Marking files as offline makes some of them go away, but I do see a read
happening when I right-click and hit ‘Properties’.

Marking the file offline does not make that one go away. I’d really
rather not restore files from the HSM server every time somebody tries
to look at the properties of a file. Does Explorer reliably stop
reading after it has read a certain amount? I can look at this with
Procmon/IrpTracker, but what explorer does today isn’t necessarily what
explorer does tomorrow. I can live with leaving a small stub on disk,
so long as I know what size to make it. Anybody have a recommendation?

~Eric

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars (including our new
fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

That’s, perhaps, because Explorer is reading binary file headers for
date/time/version/etc.

~AV

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Eric Diven
Sent: Monday, December 17, 2007 4:10 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Explorer.exe causes spurious reads?

Well, that’s interesting. I was seeing this on a .exe file, but not a
.txt file. Changed the extension, and poof, the read doesn’t happen.
Hmmm.

~Eric

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Eric Diven
Sent: Monday, December 17, 2007 3:39 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Explorer.exe causes spurious reads?

*vents*

I don’t suppose anybody could explain why Explorer.exe feels the need to
issue random reads on file when you browse the directories they’re in?
Marking files as offline makes some of them go away, but I do see a read
happening when I right-click and hit ‘Properties’.

Marking the file offline does not make that one go away. I’d really
rather not restore files from the HSM server every time somebody tries
to look at the properties of a file. Does Explorer reliably stop
reading after it has read a certain amount? I can look at this with
Procmon/IrpTracker, but what explorer does today isn’t necessarily what
explorer does tomorrow. I can live with leaving a small stub on disk,
so long as I know what size to make it. Anybody have a recommendation?

~Eric

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars (including our new
fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

Thank you for that depressing glimpse into my future. It’s like in
“It’s a Wonderful Life” where the angel comes back to show him how the
future would turn out if he killed himself, but in reverse.

Does anybody have any rope? :wink:

~Eric

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Scott Noone
Sent: Monday, December 17, 2007 4:25 PM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] Explorer.exe causes spurious reads?

Explorer issuing spurious I/O? Surely you jest…

If I were to guess, I’d say it’s probably reading the file’s resource
data so that it can display the icon in the view. If just marking it
offline isn’t working you’re probably up a creek and you’re going to be
stuck applying some kind of elegant heuristic (that of course will have
to devolve over time into a massive series of hacks as you figure out
the quirks of each revision of Explorer).

-scott

Scott Noone
Software Engineer
OSR Open Systems Resources, Inc.
http://www.osronline.com

“Eric Diven” wrote in message
news:xxxxx@ntfsd…
Well, that’s interesting. I was seeing this on a .exe file, but not a
.txt file. Changed the extension, and poof, the read doesn’t happen.
Hmmm.

~Eric

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Eric Diven
Sent: Monday, December 17, 2007 3:39 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Explorer.exe causes spurious reads?

vents

I don’t suppose anybody could explain why Explorer.exe feels the need to
issue random reads on file when you browse the directories they’re in?
Marking files as offline makes some of them go away, but I do see a read
happening when I right-click and hit ‘Properties’.

Marking the file offline does not make that one go away. I’d really
rather not restore files from the HSM server every time somebody tries
to look at the properties of a file. Does Explorer reliably stop
reading after it has read a certain amount? I can look at this with
Procmon/IrpTracker, but what explorer does today isn’t necessarily what
explorer does tomorrow. I can live with leaving a small stub on disk,
so long as I know what size to make it. Anybody have a recommendation?

~Eric

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars (including our new
fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars (including our new
fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@edsiohio.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

6

No.

Reading .rsrc for the icon is more realistic.

–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

“Alex Volynkin” wrote in message news:xxxxx@ntfsd…
> That’s, perhaps, because Explorer is reading binary file headers for
> date/time/version/etc.
>
> ~AV
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Eric Diven
> Sent: Monday, December 17, 2007 4:10 PM
> To: Windows File Systems Devs Interest List
> Subject: RE: [ntfsd] Explorer.exe causes spurious reads?
>
> Well, that’s interesting. I was seeing this on a .exe file, but not a
> .txt file. Changed the extension, and poof, the read doesn’t happen.
> Hmmm.
>
> ~Eric
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Eric Diven
> Sent: Monday, December 17, 2007 3:39 PM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] Explorer.exe causes spurious reads?
>
> vents
>
> I don’t suppose anybody could explain why Explorer.exe feels the need to
> issue random reads on file when you browse the directories they’re in?
> Marking files as offline makes some of them go away, but I do see a read
> happening when I right-click and hit ‘Properties’.
>
> Marking the file offline does not make that one go away. I’d really
> rather not restore files from the HSM server every time somebody tries
> to look at the properties of a file. Does Explorer reliably stop
> reading after it has read a certain amount? I can look at this with
> Procmon/IrpTracker, but what explorer does today isn’t necessarily what
> explorer does tomorrow. I can live with leaving a small stub on disk,
> so long as I know what size to make it. Anybody have a recommendation?
>
> ~Eric
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars (including our new
> fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
> ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>

7

Also fs filters above can theoretically send additional requests at this
time.

–
Best regards,
Vladimir Zinin
mailto:xxxxx@eldos.com

Alex Volynkin wrote:

That’s, perhaps, because Explorer is reading binary file headers for
date/time/version/etc.

~AV