NTFS stream name format

NTFSD
1

Hi,

I was just wondering about the format in which alternate data
streams for NTFS files are presented to the FSD. Specifically,
are there functions available that will parse/check filenames
with streams? If not, what are the specific rules for generating
valid ‘streamed’ names?

e.g. you could get :

1.txt:1

which is equivalent to

1.txt:1:$DATA

which is equivalent to

1.txt:1:$DATA

while

1.txt:1:$DATE

is not valid.

What are the possible values for the “$DATA” part? What do you
call the $DATA part of the stream name? Documented anywhere
(must have missed it)?

thanks in advance

2

Try to use the Nt(Zw)QueryInformationFile with
FileStreamInformation.

$DATA is NTFS’s symbolic name for file’s data attribute.
This name is defined by a special metadata file.

Paul

-----P?vodn? zpr?va-----
Od: Louis Joubert [SMTP:xxxxx@nanoteq.com]
Odesl?no: Monday, August 21, 2000 4:20 PM
Komu: File Systems Developers
P?edm?t: [ntfsd] NTFS stream name format

Hi,

I was just wondering about the format in which alternate data
streams for NTFS files are presented to the FSD. Specifically,
are there functions available that will parse/check filenames
with streams? If not, what are the specific rules for generating
valid ‘streamed’ names?

e.g. you could get :

1.txt:1

which is equivalent to

1.txt:1:$DATA

which is equivalent to

1.txt:1:$DATA

while

1.txt:1:$DATE

is not valid.

What are the possible values for the “$DATA” part? What do you
call the $DATA part of the stream name? Documented anywhere
(must have missed it)?

thanks in advance

You are currently subscribed to ntfsd as: xxxxx@sodatsw.cz
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

3

Basically all I want is to be able to strip the ‘stream’ part from
a filename, but not knowing what the exact rules are for the
correct formatting of a ‘streamed’ filename leaves me a bit
uncertain as to what special cases there may be.

I imagined that FsRtlDissectName might know how to
(reliably) strip the stream from the base filename, but
it seems not to be the case. Guess NTFS knows this
internally, and no one else needs to know the exact
details of the stream name format. Just thought some
filter drivers might need to know.

Also what other file ‘attributes’ are there? Is it
configurable?

regards

-----Original Message-----
From: Pavel Hrdina [mailto:xxxxx@sodatsw.cz]
Sent: 21 August 2000 06:13
To: File Systems Developers
Subject: [ntfsd] RE: NTFS stream name format

Try to use the Nt(Zw)QueryInformationFile with
FileStreamInformation.

$DATA is NTFS’s symbolic name for file’s data attribute.
This name is defined by a special metadata file.

Paul

> -----P?vodn? zpr?va-----
> Od: Louis Joubert [SMTP:xxxxx@nanoteq.com]
> Odesl?no: Monday, August 21, 2000 4:20 PM
> Komu: File Systems Developers
> P?edm?t: [ntfsd] NTFS stream name format
>
> Hi,
>
> I was just wondering about the format in which alternate data
> streams for NTFS files are presented to the FSD. Specifically,
> are there functions available that will parse/check filenames
> with streams? If not, what are the specific rules for generating
> valid ‘streamed’ names?
>
> e.g. you could get :
>
> 1.txt:1
>
> which is equivalent to
>
> 1.txt:1:$DATA
>
> which is equivalent to
>
> 1.txt:1:$DATA
>
> while
>
> 1.txt:1:$DATE
>
> is not valid.
>
> What are the possible values for the “$DATA” part? What do you
> call the $DATA part of the stream name? Documented anywhere
> (must have missed it)?
>
> thanks in advance
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@sodatsw.cz
> To unsubscribe send a blank email to $subst(‘Email.Unsub’)

You are currently subscribed to ntfsd as: xxxxx@Nanoteq.co.za
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

4

The path can be divided into three parts:
<lastcomponent>
where Path can be empty (for root directory contents) or must contain
one or more directories (containers; not files)
and LastComponent can be empty (for root directory itself) or
some file or directory.
Only last component (and in the case of file only) can contain colon (‘:’)
which divides the file name to :.
FileName itsels (and any other part of path) cannot contain a colon.
But the StreamName can contain additional colons.
FileName without colon and StreamName is well known (usual) unnamed
(basic) data stream (but it also have an equivalent name as ::$DATA).
But the number of data streams within one file is not limited under NTFS.

Paul

PS: NTFS attributes are transparent (except $DATA in the stream name)
to its clients and there is no method to use (or access) them directly
with the assistance of NTFS FSD.

> -----P?vodn? zpr?va-----
> Od: Louis Joubert [SMTP:xxxxx@nanoteq.com]
> Odesl?no: Tuesday, August 22, 2000 10:05 AM
> Komu: File Systems Developers
> P?edm?t: [ntfsd] RE: NTFS stream name format
>
> Basically all I want is to be able to strip the ‘stream’ part from
> a filename, but not knowing what the exact rules are for the
> correct formatting of a ‘streamed’ filename leaves me a bit
> uncertain as to what special cases there may be.
>
> I imagined that FsRtlDissectName might know how to
> (reliably) strip the stream from the base filename, but
> it seems not to be the case. Guess NTFS knows this
> internally, and no one else needs to know the exact
> details of the stream name format. Just thought some
> filter drivers might need to know.
>
> Also what other file ‘attributes’ are there? Is it
> configurable?
>
> regards
>
> > -----Original Message-----
> > From: Pavel Hrdina [mailto:xxxxx@sodatsw.cz]
> > Sent: 21 August 2000 06:13
> > To: File Systems Developers
> > Subject: [ntfsd] RE: NTFS stream name format
> >
> >
> > Try to use the Nt(Zw)QueryInformationFile with
> > FileStreamInformation.
> >
> > $DATA is NTFS’s symbolic name for file’s data attribute.
> > This name is defined by a special metadata file.
> >
> > Paul
> >
> > > -----P?vodn? zpr?va-----
> > > Od: Louis Joubert [SMTP:xxxxx@nanoteq.com]
> > > Odesl?no: Monday, August 21, 2000 4:20 PM
> > > Komu: File Systems Developers
> > > P?edm?t: [ntfsd] NTFS stream name format
> > >
> > > Hi,
> > >
> > > I was just wondering about the format in which alternate data
> > > streams for NTFS files are presented to the FSD. Specifically,
> > > are there functions available that will parse/check filenames
> > > with streams? If not, what are the specific rules for generating
> > > valid ‘streamed’ names?
> > >
> > > e.g. you could get :
> > >
> > > 1.txt:1
> > >
> > > which is equivalent to
> > >
> > > 1.txt:1:$DATA
> > >
> > > which is equivalent to
> > >
> > > 1.txt:1:$DATA
> > >
> > > while
> > >
> > > 1.txt:1:$DATE
> > >
> > > is not valid.
> > >
> > > What are the possible values for the “$DATA” part? What do you
> > > call the $DATA part of the stream name? Documented anywhere
> > > (must have missed it)?
> > >
> > > thanks in advance
> > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntfsd as: xxxxx@sodatsw.cz
> > > To unsubscribe send a blank email to $subst(‘Email.Unsub’)
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@Nanoteq.co.za
> > To unsubscribe send a blank email to $subst(‘Email.Unsub’)
> >
>
> —
> You are currently subscribed to ntfsd as: xxxxx@sodatsw.cz
> To unsubscribe send a blank email to $subst(‘Email.Unsub’)

5

Louis,

Look for colons. The first colon separates the file name from the stream
name. The second colon separates the stream name from the attribute name.

Thus “foo::$DATA” represents the null (default) stream’s data attribute.
This is what you get when you open “foo”.

As for attribute names, there are a series of defined names, but you can’t
access those (since they are internal attributes.) But you can add your
own. Make them up.

Regards,

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: Louis Joubert [mailto:xxxxx@nanoteq.com]
Sent: Tuesday, August 22, 2000 4:05 AM
To: File Systems Developers
Subject: [ntfsd] RE: NTFS stream name format

Basically all I want is to be able to strip the ‘stream’ part from
a filename, but not knowing what the exact rules are for the
correct formatting of a ‘streamed’ filename leaves me a bit
uncertain as to what special cases there may be.

I imagined that FsRtlDissectName might know how to
(reliably) strip the stream from the base filename, but
it seems not to be the case. Guess NTFS knows this
internally, and no one else needs to know the exact
details of the stream name format. Just thought some
filter drivers might need to know.

Also what other file ‘attributes’ are there? Is it
configurable?

regards

-----Original Message-----
From: Pavel Hrdina [mailto:xxxxx@sodatsw.cz]
Sent: 21 August 2000 06:13
To: File Systems Developers
Subject: [ntfsd] RE: NTFS stream name format

Try to use the Nt(Zw)QueryInformationFile with
FileStreamInformation.

$DATA is NTFS’s symbolic name for file’s data attribute.
This name is defined by a special metadata file.

Paul

> -----P?vodn? zpr?va-----
> Od: Louis Joubert [SMTP:xxxxx@nanoteq.com]
> Odesl?no: Monday, August 21, 2000 4:20 PM
> Komu: File Systems Developers
> P?edm?t: [ntfsd] NTFS stream name format
>
> Hi,
>
> I was just wondering about the format in which alternate data
> streams for NTFS files are presented to the FSD. Specifically,
> are there functions available that will parse/check filenames
> with streams? If not, what are the specific rules for generating
> valid ‘streamed’ names?
>
> e.g. you could get :
>
> 1.txt:1
>
> which is equivalent to
>
> 1.txt:1:$DATA
>
> which is equivalent to
>
> 1.txt:1:$DATA
>
> while
>
> 1.txt:1:$DATE
>
> is not valid.
>
> What are the possible values for the “$DATA” part? What do you
> call the $DATA part of the stream name? Documented anywhere
> (must have missed it)?
>
> thanks in advance
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@sodatsw.cz
> To unsubscribe send a blank email to $subst(‘Email.Unsub’)

You are currently subscribed to ntfsd as: xxxxx@Nanoteq.co.za
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to $subst(‘Email.Unsub’)