Multiple Data Streams

Hi all,

I am working on file streams, and need to understand how this works inside
the File System. Right now I do not have the test setup to try this out
real quick. Can someone help in this regard? When I create a stream on a
file (file does not already exist), say:

CreateFile (“\\server\share\foo:stream”,…)

is it a discreet operation, or is the file created first and then the
stream? Is the default unnamed stream always created for this case?
(Multiple IRP_MJ_CREATEs for each?)

Similarly, if foo has multiple streams, is
DeleteFile (“\\server\share\foo”)

a discreet operation (inside the FS)? Are all the streams deleted first
followed by the file, or is the file deleted resulting in automatic
deletion of all the streams.

Also, in the first case, if the default unnamed stream is not created,
will deletion of foo:stream result in deletion of the file foo?

Thanks in advance.
Naa.

Naagdaa,

you wrote on Wednesday, March 13, 2002, 19:22:32:

nyc> CreateFile (“\\server\share\foo:stream”,…)

nyc> is it a discreet operation, or is the file created first and then the
nyc> stream? Is the default unnamed stream always created for this case?
nyc> (Multiple IRP_MJ_CREATEs for each?)

Get FileMon from www.sysinternals.com and watch how the file/streams get
created.

Ralf.