Need Help On "Non-Recident info in NTFS Attribute"

Hi All,

I am studing NTFS file system. I found that some of the dbx(Outlook) files have stream size or initialized data size is different than real size of attribute. But in case of normal files they are same.

The problem is that if I use normal ReadFile API to read data from offset equal to
stream size then I get byte containing zeros. But if I go to the cluster they are not zeros.

Can any one explain me real size and stream size usage?

Thanks & Regards,
Amit.

It is the responsibility of the FSD to return zeroes for still not written
sectors and the reason is “Security”. However, it is not mandatory for the
FSD to actually write zeroes for those sectors on disk.

Regards,
Ayush Gupta
http://www.linkedin.com/in/guptaayush

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-371087-
xxxxx@lists.osr.com] On Behalf Of xxxxx@yahoo.com
Sent: Thursday, June 25, 2009 10:22 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Need Help On “Non-Recident info in NTFS Attribute”

Hi All,

I am studing NTFS file system. I found that some of the dbx(Outlook)
files have stream size or initialized data size is different than real
size of attribute. But in case of normal files they are same.

The problem is that if I use normal ReadFile API to read data from
offset equal to
stream size then I get byte containing zeros. But if I go to the
cluster they are not zeros.

Can any one explain me real size and stream size usage?

Thanks & Regards,
Amit.


NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer