File owner of NTFS

NTFSD
1

I am looking for a C++ API to get the owner of a file. I am traversing the
filesystem using FindFirst(), FindNext() APIs.

Thanks,
Siddharth

2

Define owner… You mean security-wise? In Win32, try GetFileSecurity()
with OWNER_SECURITY_INFORMATION. In kernel-mode, you can send the
IRP_MJ_QUERY_SECURITY IRP to a file, also asking for
OWNER_SECURITY_INFORMATION

  • Nicholas Ryan

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
Siddharth Aggarwal
Sent: Thursday, March 27, 2003 8:32 PM
To: File Systems Developers
Subject: [ntfsd] File owner of NTFS

I am looking for a C++ API to get the owner of a file. I am
traversing the filesystem using FindFirst(), FindNext() APIs.

Thanks,
Siddharth

You are currently subscribed to ntfsd as: xxxxx@nryan.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Thanks for your reply. I used the GetSecurityInfo() + LookupAccountSid()
APIs and they seem to work.

But the only problem is that for most files on my C drive, the account name
is reported as “Everyone”. On the other hand, for files on other drives, the
account is correctly reported as “Administrator” or other valid users
(actually visible via the NT user manager)

What is the reason for this behavior?

Thanks,
Siddharth.

“Nicholas Ryan” wrote in message news:xxxxx@ntfsd…
>
> Define owner… You mean security-wise? In Win32, try GetFileSecurity()
> with OWNER_SECURITY_INFORMATION. In kernel-mode, you can send the
> IRP_MJ_QUERY_SECURITY IRP to a file, also asking for
> OWNER_SECURITY_INFORMATION
>
> - Nicholas Ryan
>
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com] On Behalf Of
> > Siddharth Aggarwal
> > Sent: Thursday, March 27, 2003 8:32 PM
> > To: File Systems Developers
> > Subject: [ntfsd] File owner of NTFS
> >
> >
> > I am looking for a C++ API to get the owner of a file. I am
> > traversing the filesystem using FindFirst(), FindNext() APIs.
> >
> > Thanks,
> > Siddharth
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@nryan.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
>
>
>
>

4

To add here, my application scans the whole file system to find the files
owned by a particular user. Using the approach below, this is turning out to
be a very expensive technique because everytime I need to open the file and
use the handle to call the APIs below. Is there a cheaper way of obtaining
this information?
e.g. UID field supplied by *nix.

Thanks,
Siddharth

“Siddharth Aggarwal” wrote in message
news:xxxxx@ntfsd…
>
> Thanks for your reply. I used the GetSecurityInfo() + LookupAccountSid()
> APIs and they seem to work.
>
> But the only problem is that for most files on my C drive, the account
name
> is reported as “Everyone”. On the other hand, for files on other drives,
the
> account is correctly reported as “Administrator” or other valid users
> (actually visible via the NT user manager)
>
> What is the reason for this behavior?
>
> Thanks,
> Siddharth.
>
> “Nicholas Ryan” wrote in message news:xxxxx@ntfsd…
> >
> > Define owner… You mean security-wise? In Win32, try GetFileSecurity()
> > with OWNER_SECURITY_INFORMATION. In kernel-mode, you can send the
> > IRP_MJ_QUERY_SECURITY IRP to a file, also asking for
> > OWNER_SECURITY_INFORMATION
> >
> > - Nicholas Ryan
> >
> > > -----Original Message-----
> > > From: xxxxx@lists.osr.com
> > > [mailto:xxxxx@lists.osr.com] On Behalf Of
> > > Siddharth Aggarwal
> > > Sent: Thursday, March 27, 2003 8:32 PM
> > > To: File Systems Developers
> > > Subject: [ntfsd] File owner of NTFS
> > >
> > >
> > > I am looking for a C++ API to get the owner of a file. I am
> > > traversing the filesystem using FindFirst(), FindNext() APIs.
> > >
> > > Thanks,
> > > Siddharth
> > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntfsd as: xxxxx@nryan.com
> > > To unsubscribe send a blank email to xxxxx@lists.osr.com
> > >
> >
> >
> >
> >
>
>
>
>

5

There’s no way to get this information without a valid file handle. As
to why you’re seeing the owner as ‘Everyone’… Jeez, that’s strange.
You’re sure your C: drive is NTFS? If it’s FAT, you will get ‘Everyone’
as the owner - the function will not fail.

  • Nicholas Ryan

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
Siddharth Aggarwal
Sent: Friday, March 28, 2003 4:14 AM
To: File Systems Developers
Subject: [ntfsd] Re: File owner of NTFS

To add here, my application scans the whole file system to
find the files owned by a particular user. Using the approach
below, this is turning out to be a very expensive technique
because everytime I need to open the file and use the handle
to call the APIs below. Is there a cheaper way of obtaining
this information? e.g. UID field supplied by *nix.

Thanks,
Siddharth

“Siddharth Aggarwal”
> wrote in message news:xxxxx@ntfsd…
> >
> > Thanks for your reply. I used the GetSecurityInfo() +
> > LookupAccountSid() APIs and they seem to work.
> >
> > But the only problem is that for most files on my C drive,
> the account
> name
> > is reported as “Everyone”. On the other hand, for files on other
> > drives,
> the
> > account is correctly reported as “Administrator” or other
> valid users
> > (actually visible via the NT user manager)
> >
> > What is the reason for this behavior?
> >
> > Thanks,
> > Siddharth.
> >
> > “Nicholas Ryan” wrote in message
news:xxxxx@ntfsd…
> >
> > Define owner… You mean security-wise? In Win32, try
> > GetFileSecurity() with OWNER_SECURITY_INFORMATION. In kernel-mode,
> > you can send the IRP_MJ_QUERY_SECURITY IRP to a file, also asking
> > for OWNER_SECURITY_INFORMATION
> >
> > - Nicholas Ryan
> >
> > > -----Original Message-----
> > > From: xxxxx@lists.osr.com
> > > [mailto:xxxxx@lists.osr.com] On Behalf Of Siddharth
> > > Aggarwal
> > > Sent: Thursday, March 27, 2003 8:32 PM
> > > To: File Systems Developers
> > > Subject: [ntfsd] File owner of NTFS
> > >
> > >
> > > I am looking for a C++ API to get the owner of a file. I am
> > > traversing the filesystem using FindFirst(), FindNext() APIs.
> > >
> > > Thanks,
> > > Siddharth
> > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntfsd as: xxxxx@nryan.com To
> > > unsubscribe send a blank email to xxxxx@lists.osr.com
> > >
> >
> >
> >
> >
>
>
>
>

—
You are currently subscribed to ntfsd as: xxxxx@nryan.com
To unsubscribe send a blank email to xxxxx@lists.osr.com