Get file size?

NTFSD
1

Hi,
what’s the best way to get the size of a given file?
CcGetFileSizePointer?,
FltQueryInformationFile + FILE_STANDARD_INFORMATION:EndOfFile?, or
FltQueryInformationFile + FILE_STANDARD_INFORMATION:AllocationSize?

or all of them are equals?:S

THX.

2

From: http://msdn.microsoft.com/en-us/library/ff540232(VS.85).aspx
“A file’s allocation size and end-of-file position are independent of each other, with the following exception: The end-of-file position must always be less than or equal to the allocation size. If the allocation size is set to a value that is less than the end-of-file position, the end-of-file position is automatically adjusted to match the allocation size.”

Allocation size is rounded up to file system cluster boundary, so you probably want EndOfFile.

3

You don’t say what you are, but I’ll assume an FSFD…

CcGetFileSizePointer?,

Not your call to make, it might be correct, but without understanding the
FSD you’ll never be sure…

FltQueryInformationFile + FILE_STANDARD_INFORMATION:EndOfFile?, or

Where the end of file is (usually under the applications control). As the
previous post said - this is probably what you want…

FltQueryInformationFile + FILE_STANDARD_INFORMATION:AllocationSize?

How much space on disk the file takes. The application can set this and
read it, but the filesystem also changes it (usually to truncate it to a
rounding of Eof on close).

You also missed out FILE_VALID_DATA_LENGTH_INFORMATION, which is maintained
by the cache manager + Filesystem and maintains where the high water mark of
writing the file is (reads beyond VDL come back as zero).

Rod

wrote in message news:xxxxx@ntfsd…
> Hi,
> what’s the best way to get the size of a given file?
> CcGetFileSizePointer?,
> FltQueryInformationFile + FILE_STANDARD_INFORMATION:EndOfFile?, or
> FltQueryInformationFile + FILE_STANDARD_INFORMATION:AllocationSize?
>
> or all of them are equals?:S
>
> THX.
>