FILE_END_OF_FILE_INFORMATION

NTFSD
1

Hi All,

Sorry if this question has been asked before, but couldn’t find it in the archives.

If I were to call ZwSetInformationFile with information class FILE_END_OF_FILE_INFORMATION to change the file size of an empty file from 0 to say 400KB, does that actually change how much space the file takes on disk or just the property? How could I actually verify this?

Thanks in advance for any help.

2

Go look at the implementation of FatSetEndOfFileInfo in the WDK
sources. If the new size is greater than the current allocation for
the file, then more space is going to be allocated. In general
filesystems guarantee that if a file is N bytes long, there is at
least N bytes allocated for that file on disk. Sparse files obviously
complicate this, so assume that we are only talking about normal
files.

On Nov 9, 2007 12:15 PM, wrote:
> Hi All,
>
> Sorry if this question has been asked before, but couldn’t find it in the archives.
>
> If I were to call ZwSetInformationFile with information class FILE_END_OF_FILE_INFORMATION to change the file size of an empty file from 0 to say 400KB, does that actually change how much space the file takes on disk or just the property? How could I actually verify this?
>
> Thanks in advance for any help.
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@hollistech.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

–
Mark Roddy

3

Compressed files also complicate this.

Mark Roddy wrote:

Go look at the implementation of FatSetEndOfFileInfo in the WDK
sources. If the new size is greater than the current allocation for
the file, then more space is going to be allocated. In general
filesystems guarantee that if a file is N bytes long, there is at
least N bytes allocated for that file on disk. Sparse files obviously
complicate this, so assume that we are only talking about normal
files.

On Nov 9, 2007 12:15 PM, wrote:
> > Hi All,
> >
> > Sorry if this question has been asked before, but couldn’t find it in the archives.
> >
> > If I were to call ZwSetInformationFile with information class FILE_END_OF_FILE_INFORMATION to change the file size of an empty file from 0 to say 400KB, does that actually change how much space the file takes on disk or just the property? How could I actually verify this?
> >
> > Thanks in advance for any help.
> >
> > —
> > NTFSD is sponsored by OSR
> >
> > For our schedule debugging and file system seminars
> > (including our new fs mini-filter seminar) visit:
> > http://www.osr.com/seminars
> >
> > You are currently subscribed to ntfsd as: xxxxx@hollistech.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
>
> –
> Mark Roddy
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@alfasp.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

–
Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.