Identify the same file stream

NTFSD
1

Hello,

I searched the archive and found no viable way to
uniquely identify a file. One way Maxim Shatskih
sugested was to query for the first logical
cluster number of the file stream, but a small file
can fully reside in the MFT so no luck there.

As I understood, the first time a file stream is
opened/created and the file system context is created,
it will take the name that was used to open/create
that file stream. So on next
IRP_MJ_QUERY_INFORMATION/FileNameInformation the name
returned will be the one used when the FCB was
created. When this context is created I log the file
using that name.

The problem arises when a file system context is
deleted internally by the file system and after some
time the file stream is opened so the file system
context will be created with the file stream name used
that time in IRP_MJ_CREATE, which could be different
than the one I used when logging (e.g. a short name
instead of a full name which was used the first time).
Any future
IRP_MJ_QUERY_INFORMATION/FileNameInformation will
return that name.

I thought of this for some time and I couldn’t find a
way on how to identify that it is the same file stream
as the first logged one. Obviously I can’t do it by
name comparision and since the file system context
changes, I can’t do it by that either. Any ideas?

Best regards,
Razvan

Do you Yahoo!?
Take Yahoo! Mail with you! Get it on your mobile phone.
http://mobile.yahoo.com/maildemo

2

Did you consider query for file ID
(IRP_MJ_QUERY_INFORMATION/FileInternalInformation)?
Different streams of the same *file*, will have the same file ID.
WBR Primoz

-----Original Message-----
From: Razvan Hobeanu [mailto:xxxxx@yahoo.com]
Sent: Wednesday, January 12, 2005 1:28 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Identify the same file stream

Hello,

I searched the archive and found no viable way to
uniquely identify a file. One way Maxim Shatskih
sugested was to query for the first logical
cluster number of the file stream, but a small file
can fully reside in the MFT so no luck there.

As I understood, the first time a file stream is
opened/created and the file system context is created,
it will take the name that was used to open/create
that file stream. So on next
IRP_MJ_QUERY_INFORMATION/FileNameInformation the name
returned will be the one used when the FCB was
created. When this context is created I log the file
using that name.

The problem arises when a file system context is
deleted internally by the file system and after some
time the file stream is opened so the file system
context will be created with the file stream name used
that time in IRP_MJ_CREATE, which could be different
than the one I used when logging (e.g. a short name
instead of a full name which was used the first time).
Any future
IRP_MJ_QUERY_INFORMATION/FileNameInformation will
return that name.

I thought of this for some time and I couldn’t find a
way on how to identify that it is the same file stream
as the first logged one. Obviously I can’t do it by
name comparision and since the file system context
changes, I can’t do it by that either. Any ideas?

Best regards,
Razvan

Do you Yahoo!?
Take Yahoo! Mail with you! Get it on your mobile phone.
http://mobile.yahoo.com/maildemo

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@hermes.si
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

> Did you consider query for file ID

(IRP_MJ_QUERY_INFORMATION/FileInternalInformation)?
Different streams of the same *file*, will have the same file ID.
WBR Primoz

This is good, but will work on NTFS only …

L.

4

Hello,

Did you consider query for file ID
(IRP_MJ_QUERY_INFORMATION/FileInternalInformation)?
Different streams of the same *file*, will have the
same file ID.
WBR Primoz

Thanks for the tip. That might be useful to some
point, but the additional restriction seems to make
things worse. Is the behaviour you mentined same for
both NTFS and FAT? Do different streams of the same
file have the same file ID?

Best regards,
Razvan

Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com

5

I know for NTFS, that query for FileInternalInformation on different file
streams (e.g. alternate data streams) of the same *file* will return the
same file ID. As Ladislav pointed, not all file systems support file IDs
(FAT does not).
WBR Primoz

-----Original Message-----
From: Razvan Hobeanu [mailto:xxxxx@yahoo.com]
Sent: Wednesday, January 12, 2005 2:01 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Identify the same file stream

Hello,

Did you consider query for file ID
(IRP_MJ_QUERY_INFORMATION/FileInternalInformation)?
Different streams of the same *file*, will have the
same file ID.
WBR Primoz

Thanks for the tip. That might be useful to some
point, but the additional restriction seems to make
things worse. Is the behaviour you mentined same for
both NTFS and FAT? Do different streams of the same
file have the same file ID?

Best regards,
Razvan

Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@hermes.si
To unsubscribe send a blank email to xxxxx@lists.osr.com

6

So I guess I should keep my initial conclusion that
there is no way to achieve this. Any other ideas or is
this a dead end?

Best regards,
Razvan

— Primoz Beltram wrote:

> I know for NTFS, that query for
> FileInternalInformation on different file
> streams (e.g. alternate data streams) of the same
> file will return the
> same file ID. As Ladislav pointed, not all file
> systems support file IDs
> (FAT does not).
> WBR Primoz
>
> -----Original Message-----
> From: Razvan Hobeanu
> [mailto:xxxxx@yahoo.com]
> Sent: Wednesday, January 12, 2005 2:01 PM
> To: Windows File Systems Devs Interest List
> Subject: RE: [ntfsd] Identify the same file stream
>
> Hello,
>
> > Did you consider query for file ID
> >
> (IRP_MJ_QUERY_INFORMATION/FileInternalInformation)?
> > Different streams of the same file, will have
> the
> > same file ID.
> > WBR Primoz
>
> Thanks for the tip. That might be useful to some
> point, but the additional restriction seems to make
> things worse. Is the behaviour you mentined same for
> both NTFS and FAT? Do different streams of the same
> file have the same file ID?
>
> Best regards,
> Razvan
>

__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com

7

It is not true that FAT doesn’t support file ID at all. It doesn’t allow to
open file using file ID but it returns file ID in response to
IRP_MJ_QUERY_INFORMATION/FileInternalInformation. And then FAT doesn’t
support alternative streams, so your problems doesn’t exist on FAT, right?

Alexei.

-----Original Message-----
From: Razvan Hobeanu [mailto:xxxxx@yahoo.com]
Sent: Wednesday, January 12, 2005 2:32 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Identify the same file stream

So I guess I should keep my initial conclusion that
there is no way to achieve this. Any other ideas or is
this a dead end?

Best regards,
Razvan

— Primoz Beltram wrote:

> I know for NTFS, that query for
> FileInternalInformation on different file
> streams (e.g. alternate data streams) of the same
> file will return the
> same file ID. As Ladislav pointed, not all file
> systems support file IDs
> (FAT does not).
> WBR Primoz
>
> -----Original Message-----
> From: Razvan Hobeanu
> [mailto:xxxxx@yahoo.com]
> Sent: Wednesday, January 12, 2005 2:01 PM
> To: Windows File Systems Devs Interest List
> Subject: RE: [ntfsd] Identify the same file stream
>
> Hello,
>
> > Did you consider query for file ID
> >
> (IRP_MJ_QUERY_INFORMATION/FileInternalInformation)?
> > Different streams of the same file, will have
> the
> > same file ID.
> > WBR Primoz
>
> Thanks for the tip. That might be useful to some
> point, but the additional restriction seems to make
> things worse. Is the behaviour you mentined same for
> both NTFS and FAT? Do different streams of the same
> file have the same file ID?
>
> Best regards,
> Razvan
>

__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@vmware.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

8

> And then FAT doesn’t

support alternative streams, so your problems
doesn’t exist on FAT, right?

Alexei.

I’m not interested in alternative streams in
particular. I was talking about files in general. I
used the term “file streams” instead of “files”
because it is a known fact that 1 FsContext
corresponds to 1 File Stream (because on NTFS a file
can have multiple streams so that different file
streams of the same file have different FsContexts).
Sorry for the misunderstanding.

Best regards,
Razvan

-----Original Message-----
From: Razvan Hobeanu
[mailto:xxxxx@yahoo.com]
Sent: Wednesday, January 12, 2005 2:32 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Identify the same file stream

So I guess I should keep my initial conclusion that
there is no way to achieve this. Any other ideas or
is
this a dead end?

Best regards,
Razvan

— Primoz Beltram wrote:
>
> > I know for NTFS, that query for
> > FileInternalInformation on different file
> > streams (e.g. alternate data streams) of the same
> > file will return the
> > same file ID. As Ladislav pointed, not all file
> > systems support file IDs
> > (FAT does not).
> > WBR Primoz
> >
> > -----Original Message-----
> > From: Razvan Hobeanu
> > [mailto:xxxxx@yahoo.com]
> > Sent: Wednesday, January 12, 2005 2:01 PM
> > To: Windows File Systems Devs Interest List
> > Subject: RE: [ntfsd] Identify the same file stream
> >
> > Hello,
> >
> > > Did you consider query for file ID
> > >
> >
> (IRP_MJ_QUERY_INFORMATION/FileInternalInformation)?
> > > Different streams of the same file, will have
> > the
> > > same file ID.
> > > WBR Primoz
> >
> > Thanks for the tip. That might be useful to some
> > point, but the additional restriction seems to
> make
> > things worse. Is the behaviour you mentined same
> for
> > both NTFS and FAT? Do different streams of the
> same
> > file have the same file ID?
> >
> > Best regards,
> > Razvan
> >

__________________________________
Do you Yahoo!?
Take Yahoo! Mail with you! Get it on your mobile phone.
http://mobile.yahoo.com/maildemo

9

FAT uses the first cluster number as a file ID. Only defrag can change it,
and it is also reusable - can be reused after deletion of this file.

NTFS file IDs are defrag-safe and non-reusable.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Alexei Jelvis”
To: “Windows File Systems Devs Interest List”
Sent: Thursday, January 13, 2005 2:08 AM
Subject: RE: [ntfsd] Identify the same file stream

It is not true that FAT doesn’t support file ID at all. It doesn’t allow to
open file using file ID but it returns file ID in response to
IRP_MJ_QUERY_INFORMATION/FileInternalInformation. And then FAT doesn’t
support alternative streams, so your problems doesn’t exist on FAT, right?

Alexei.

-----Original Message-----
From: Razvan Hobeanu [mailto:xxxxx@yahoo.com]
Sent: Wednesday, January 12, 2005 2:32 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Identify the same file stream

So I guess I should keep my initial conclusion that
there is no way to achieve this. Any other ideas or is
this a dead end?

Best regards,
Razvan

— Primoz Beltram wrote:

> I know for NTFS, that query for
> FileInternalInformation on different file
> streams (e.g. alternate data streams) of the same
> file will return the
> same file ID. As Ladislav pointed, not all file
> systems support file IDs
> (FAT does not).
> WBR Primoz
>
> -----Original Message-----
> From: Razvan Hobeanu
> [mailto:xxxxx@yahoo.com]
> Sent: Wednesday, January 12, 2005 2:01 PM
> To: Windows File Systems Devs Interest List
> Subject: RE: [ntfsd] Identify the same file stream
>
> Hello,
>
> > Did you consider query for file ID
> >
> (IRP_MJ_QUERY_INFORMATION/FileInternalInformation)?
> > Different streams of the same file, will have
> the
> > same file ID.
> > WBR Primoz
>
> Thanks for the tip. That might be useful to some
> point, but the additional restriction seems to make
> things worse. Is the behaviour you mentined same for
> both NTFS and FAT? Do different streams of the same
> file have the same file ID?
>
> Best regards,
> Razvan
>

__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@vmware.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com