Long name vs. Short name on NTFS

OSR_Community_User · September 18, 2003, 2:29am

Hi, all,

There is a feature (maybe bug ?) on NTFS file system.

If you open a file using short name, then query the name using
ObQueryNameString, NTFS will return short name to you.

If you open a file using long name and then query the name,
NTFS will return the long name.

The question is:
Is it possible to make NTFS return ALWAYS the long name ?

I saw some trick in FILEMON sources - Clearing the FsContext2 in
the file object (setting to NULL), then calling
IRJ_MJ_QUERY_INFORMATION, then restoring the FsContext2 back to
the original value. But this seems as dirty hack to me, and I
would like to avoid this method. Does anyone know how to do it ?

Ladislav Zezula

–
Vyhraj Ford Fiesta s klimatizac? a dal?? ceny!
V?ce na http://soutez.volny.cz

OSR_Community_User · September 18, 2003, 9:01am

As far as I know on XP and Later you can do IRP_MJ_QUERY_INFORMATION looking
for FileNameInformation and you will get returned the Long Name of the File.
On W2k, this will not work. You have to open up the parent directory and
do a IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY call and pass in the
filename of the object that you require the long name for.

–Mark

–
Mark Cariddi
Consulting Associate
OSR, Open Systems Resources, Inc.
http://www.osr.com/
“Ladislav Zezula” wrote in message news:xxxxx@ntfsd…

Hi, all,

There is a feature (maybe bug ?) on NTFS file system.

If you open a file using short name, then query the name using
ObQueryNameString, NTFS will return short name to you.

If you open a file using long name and then query the name,
NTFS will return the long name.

The question is:
Is it possible to make NTFS return ALWAYS the long name ?

I saw some trick in FILEMON sources - Clearing the FsContext2 in
the file object (setting to NULL), then calling
IRJ_MJ_QUERY_INFORMATION, then restoring the FsContext2 back to
the original value. But this seems as dirty hack to me, and I
would like to avoid this method. Does anyone know how to do it ?

Ladislav Zezula

–
Vyhraj Ford Fiesta s klimatizací a dal¹í ceny!
Více na http://soutez.volny.cz

OSR_Community_User · September 18, 2003, 12:58pm

The first part of what Mark said is not correct.

On XP and later, if you do an IRP_MJ_QUERY_INFORMATION on either NTFS and FAT they will return to you the name that was used by the user to open this file object. If the user opened the file with the short name, you get the short name; if the user opened the file with the long name, you get the long name.

NTFS has always behaved like this, but FAT was less consistent. You need this behavior to properly handle name tunneling when files are renamed.

The second part of what Mark said is correct – on all OS versions, the steps Mark outlines for getting the long name by quering the parent is what you need to do. You can bypass this work if you know the file name is not a valid short name format – more than 12 characters or has an extention longer than 3 characters. It is not correct to assume that all short names contain a ‘~’ character and only expand those. If you have a large number of files with the similar names, the file systems end up running out of unique patterns using the typical “~[number]” short name format and will start creating short names which don’t contain a ‘~’.

Thanks,
Molly Brown
Microsoft Corporation

This posting is provided “AS IS” with no warranties and confers no rights.

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Mark Cariddi
Sent: Thursday, September 18, 2003 6:04 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Re: Long name vs. Short name on NTFS

As far as I know on XP and Later you can do IRP_MJ_QUERY_INFORMATION looking for FileNameInformation and you will get returned the Long Name of the File.
On W2k, this will not work. You have to open up the parent directory and
do a IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY call and pass in the filename of the object that you require the long name for.

–Mark

–
Mark Cariddi
Consulting Associate
OSR, Open Systems Resources, Inc.
http://www.osr.com/
“Ladislav Zezula” wrote in message news:xxxxx@ntfsd…

Hi, all,

There is a feature (maybe bug ?) on NTFS file system.

If you open a file using short name, then query the name using ObQueryNameString, NTFS will return short name to you.

If you open a file using long name and then query the name, NTFS will return the long name.

The question is:
Is it possible to make NTFS return ALWAYS the long name ?

I saw some trick in FILEMON sources - Clearing the FsContext2 in the file object (setting to NULL), then calling IRJ_MJ_QUERY_INFORMATION, then restoring the FsContext2 back to the original value. But this seems as dirty hack to me, and I would like to avoid this method. Does anyone know how to do it ?

Ladislav Zezula

–
Vyhraj Ford Fiesta s klimatizac? a dal?? ceny!
V?ce na http://soutez.volny.cz

—
You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Nick_Ryan · September 18, 2003, 2:05pm

The trick with setting FsContext2 to NULL is a technique used by the
lazy writer, as this comment from FastFat illustrates:

// Note: The Ccb can be NULL. The lazy writer calls to get the name of
// a DirectoryOpen FILE_OBJECT that it wants to display in the lost
// delayed write popup. Handle this case by just using the FileFullName.

I would be hesistant to rely on this, however. Better to use the
technique Molly suggested.

Ladislav Zezula wrote:

Hi, all,

There is a feature (maybe bug ?) on NTFS file system.

If you open a file using short name, then query the name using
ObQueryNameString, NTFS will return short name to you.

If you open a file using long name and then query the name,
NTFS will return the long name.

The question is:
Is it possible to make NTFS return ALWAYS the long name ?

I saw some trick in FILEMON sources - Clearing the FsContext2 in
the file object (setting to NULL), then calling
IRJ_MJ_QUERY_INFORMATION, then restoring the FsContext2 back to
the original value. But this seems as dirty hack to me, and I
would like to avoid this method. Does anyone know how to do it ?

Ladislav Zezula

–
Nick Ryan (MVP for DDK)

OSR_Community_User · September 19, 2003, 2:49am

In my FSFD I’m using RtlIsNameLegalDOS8Dot3 to determine if I need to send
an IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY to get LFN for
FileObject. Until now I didn’t face any problems with it. WBR Primoz

-----Original Message-----
From: Nick Ryan [mailto:xxxxx@nryan.com]
Sent: Thursday, September 18, 2003 8:04 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Re: Long name vs. Short name on NTFS

The trick with setting FsContext2 to NULL is a technique used by the
lazy writer, as this comment from FastFat illustrates:

// Note: The Ccb can be NULL. The lazy writer calls to get
the name of // a DirectoryOpen FILE_OBJECT that it wants to
display in the lost // delayed write popup. Handle this
case by just using the FileFullName.

I would be hesistant to rely on this, however. Better to use the
technique Molly suggested.

Ladislav Zezula wrote:

> Hi, all,
>
> There is a feature (maybe bug ?) on NTFS file system.
>
> If you open a file using short name, then query the name using
> ObQueryNameString, NTFS will return short name to you.
>
> If you open a file using long name and then query the name,
NTFS will
> return the long name.
>
> The question is:
> Is it possible to make NTFS return ALWAYS the long name ?
>
> I saw some trick in FILEMON sources - Clearing the
FsContext2 in the
> file object (setting to NULL), then calling
IRJ_MJ_QUERY_INFORMATION,
> then restoring the FsContext2 back to the original value. But this
> seems as dirty hack to me, and I would like to avoid this
method. Does
> anyone know how to do it ?
>
> Ladislav Zezula
>
>

–
Nick Ryan (MVP for DDK)

You are currently subscribed to ntfsd as:
xxxxx@hermes.si To unsubscribe send a blank email to
xxxxx@lists.osr.com

Nick_Ryan · September 19, 2003, 2:14pm

This is a good optimization, I’ll remember it. Be aware that any element
in the pathname can be either long or short, so you must check every
element and not just the filename.

Primoz Beltram wrote:

In my FSFD I’m using RtlIsNameLegalDOS8Dot3 to determine if I need to send
an IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY to get LFN for
FileObject. Until now I didn’t face any problems with it. WBR Primoz

>-----Original Message-----
>From: Nick Ryan [mailto:xxxxx@nryan.com]
>Sent: Thursday, September 18, 2003 8:04 PM
>To: Windows File Systems Devs Interest List
>Subject: [ntfsd] Re: Long name vs. Short name on NTFS
>
>
>The trick with setting FsContext2 to NULL is a technique used by the
>lazy writer, as this comment from FastFat illustrates:
>
>// Note: The Ccb can be NULL. The lazy writer calls to get
>the name of // a DirectoryOpen FILE_OBJECT that it wants to
>display in the lost // delayed write popup. Handle this
>case by just using the FileFullName.
>
>I would be hesistant to rely on this, however. Better to use the
>technique Molly suggested.
>
>Ladislav Zezula wrote:
>
>
>>Hi, all,
>>
>>There is a feature (maybe bug ?) on NTFS file system.
>>
>>If you open a file using short name, then query the name using
>>ObQueryNameString, NTFS will return short name to you.
>>
>>If you open a file using long name and then query the name,
>
>NTFS will
>
>>return the long name.
>>
>>The question is:
>>Is it possible to make NTFS return ALWAYS the long name ?
>>
>>I saw some trick in FILEMON sources - Clearing the
>
>FsContext2 in the
>
>>file object (setting to NULL), then calling
>
>IRJ_MJ_QUERY_INFORMATION,
>
>>then restoring the FsContext2 back to the original value. But this
>>seems as dirty hack to me, and I would like to avoid this
>
>method. Does
>
>>anyone know how to do it ?
>>
>>Ladislav Zezula
>>
>>
>
>–
>Nick Ryan (MVP for DDK)
>
>
>—
>You are currently subscribed to ntfsd as:
>xxxxx@hermes.si To unsubscribe send a blank email to
>xxxxx@lists.osr.com
>

–
Nick Ryan (MVP for DDK)

OSR_Community_User · September 20, 2003, 8:05am

Thank you all for the advices.

L. Zezula

–
Vyhraj Ford Fiesta s klimatizac? a dal?? ceny!
V?ce na http://soutez.volny.cz

OSR_Community_User · September 21, 2003, 9:15am

Thanks for correcting me.

–Mark

–
Mark Cariddi
Consulting Associate
OSR, Open Systems Resources, Inc.
http://www.osr.com/
“Molly Brown” wrote in message
news:xxxxx@ntfsd…

The first part of what Mark said is not correct.

On XP and later, if you do an IRP_MJ_QUERY_INFORMATION on either NTFS and
FAT they will return to you the name that was used by the user to open this
file object. If the user opened the file with the short name, you get the
short name; if the user opened the file with the long name, you get the long
name.

NTFS has always behaved like this, but FAT was less consistent. You need
this behavior to properly handle name tunneling when files are renamed.

The second part of what Mark said is correct – on all OS versions, the
steps Mark outlines for getting the long name by quering the parent is what
you need to do. You can bypass this work if you know the file name is not a
valid short name format – more than 12 characters or has an extention
longer than 3 characters. It is not correct to assume that all short names
contain a ‘~’ character and only expand those. If you have a large number
of files with the similar names, the file systems end up running out of
unique patterns using the typical “~[number]” short name format and will
start creating short names which don’t contain a ‘~’.

Thanks,
Molly Brown
Microsoft Corporation

This posting is provided “AS IS” with no warranties and confers no rights.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Cariddi
Sent: Thursday, September 18, 2003 6:04 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Re: Long name vs. Short name on NTFS

As far as I know on XP and Later you can do IRP_MJ_QUERY_INFORMATION looking
for FileNameInformation and you will get returned the Long Name of the File.
On W2k, this will not work. You have to open up the parent directory and
do a IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY call and pass in the
filename of the object that you require the long name for.

–Mark

–
Mark Cariddi
Consulting Associate
OSR, Open Systems Resources, Inc.
http://www.osr.com/
“Ladislav Zezula” wrote in message news:xxxxx@ntfsd…

Hi, all,

There is a feature (maybe bug ?) on NTFS file system.

If you open a file using short name, then query the name using
ObQueryNameString, NTFS will return short name to you.

If you open a file using long name and then query the name, NTFS will return
the long name.

The question is:
Is it possible to make NTFS return ALWAYS the long name ?

I saw some trick in FILEMON sources - Clearing the FsContext2 in the file
object (setting to NULL), then calling IRJ_MJ_QUERY_INFORMATION, then
restoring the FsContext2 back to the original value. But this seems as dirty
hack to me, and I would like to avoid this method. Does anyone know how to
do it ?

Ladislav Zezula

–
Vyhraj Ford Fiesta s klimatizací a dal¹í ceny!
Více na http://soutez.volny.cz

—
You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

OSR_Community_User · September 22, 2003, 2:27pm

>work if you know the file name is not a valid short name format – more than
12 characters or

has an extention longer than 3 characters.

There are also some rules on what characters are allowed to be in short names,
and what are not. ‘.’ is not allowed, for instance.

RtlIsNameLegalDOS8Dot3 function from NTIFS.H is a solution.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

OSR_Community_User · September 23, 2003, 4:13am

The only thing that I don’t like on method which Molly suggested
(querying the directory for getting the long file name) is that
for a very long paths, e.g.
C:\Dir1\Dir2\Dir3\Dir1\Dir2\Dir3\File.exe,
I must query every part of the path. Doing that inside
IRP_MJ_CREATE, this would significantly degrade performance of
the entire operating system, I think.

L.

–
Potrebujete vice prostoru pro vase stranky?
Ptejte se na http://sluzby.volny.cz/cs/product/ftp_paid

Nick_Ryan · September 23, 2003, 8:00am

It might. Therefore it makes sense to architect your driver in such a
way that you can operate without having to know the full long pathname
of every open file. I have.

Ladislav Zezula wrote:

The only thing that I don’t like on method which Molly suggested
(querying the directory for getting the long file name) is that
for a very long paths, e.g.
C:\Dir1\Dir2\Dir3\Dir1\Dir2\Dir3\File.exe,
I must query every part of the path. Doing that inside
IRP_MJ_CREATE, this would significantly degrade performance of
the entire operating system, I think.

L.

–
Nick Ryan (MVP for DDK)

Lyndon_J_Clarke-2 · September 29, 2003, 11:14am

Mmm interesting … my approach might have been a bit simple minded. I
keep a cache of could-be-short-name to long-name translations which seems
to work pretty well for me.