Hey
hey, I’m trying to query the file size using FsRtlGetFileSize and FltQueryInformationFile
Params are correct , it worked for me before
Actually, it still works rarely but testing it against a large folder of files , and writing to them it returns 0, and they are not empty
not sure why is that …
Sorry, but you need to provide more information on what you're doing, what you're expecting, and what you're trying to achieve. Also, which file system? Local or network?
Local, trying to read file content in pre write and store it in memory , for potentially restoring the file upon close based on other, irrelevant logic happening within the post close filter
I’m expecting, well, that since I overwritten existing image files the pre write call to get the size will not return 0…
Also, if I open a file in notepad manually , edit it and save it the file size if correct and it all works, maybe there’s something I don’t understand about Python file.write() that causes this?
For what it’s worth , allocation size is also 0…
One last thing that may help you help me out here, whilst my filter is active , if. I paste a file to a new location the pre write filter on that target folder returns the correct size , but if the file is already present in a target directory and then overwritten I get size 0
the file is probably opened with the truncate flag , move to pre create , look at the create dispostion value. Either FILE_OVERWRITE,
FILE_OVERWRITE_IF or FILE_SUPERSEDE may truncate the file if successful.
1 Like
Run ProcMon (in Advanced Mode) and study the file system operations that occur during all of these different scenarios. Then you can work out your design and what it is you're not understanding/handling.
1 Like