NtQueryDirectoryFile with alternative data streams?

(If this is the wrong place to ask questions like this, can you please
direct me to the correct place?)

I have user code that is trying to open an alternative data stream and get
FileIdFullDirectoryInformation. This is the code:

fileHandle = CreateFileW ( DirPath, GENERIC_READ,
FILE_SHARE_READ|FILE_SHARE_WRITE, NULL, OPEN_EXISTING,
FILE_FLAG_BACKUP_SEMANTICS, 0 );

status = NtQueryDirectoryFile( fileHandle, NULL, NULL, NULL, &ioStatus,
pbuf, bufSize, FileIdFullDirectoryInformation, TRUE, &FileNameStr, TRUE );

The stream path is: \test.txt:testads:$DATA

I have tried this with and without the :$DATA and in both cases the
CreateFileW works fine but the NtQueryDirectoryFile returns C0000033 which
is OBJECT_NAME_INVALID. Notepad can open the stream.

Is NtQueryDirectoryFile supposed to work with alternative data streams? If
not, then does this mean that the alternative streams do not have attributes
such as create-time?

NtQueryDirectoryFile works on directories, not files and not on streams.

The attributes apply to the file, not to the stream. There is no
separate set of timestamps per stream; when you query the file you’ll
get the size information for the default data stream.

If you want the information for the streams you need to use
IRP_MJ_QUERY_INFORMATION/FileStreamInformation.

Oh, and keep in mind: directories support streams as well…

And final caveat: we’re talking about the NTFS implementation of streams
here. There ARE other file systems that implement and support streams
(by that name or any other name…)

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
Sent: Wednesday, August 10, 2005 6:55 PM
To: ntfsd redirect
Subject: [ntfsd] NtQueryDirectoryFile with alternative data streams?

(If this is the wrong place to ask questions like this, can you please
direct me to the correct place?)

I have user code that is trying to open an alternative data stream and
get
FileIdFullDirectoryInformation. This is the code:

fileHandle = CreateFileW ( DirPath, GENERIC_READ,
FILE_SHARE_READ|FILE_SHARE_WRITE, NULL, OPEN_EXISTING,
FILE_FLAG_BACKUP_SEMANTICS, 0 );

status = NtQueryDirectoryFile( fileHandle, NULL, NULL, NULL, &ioStatus,
pbuf, bufSize, FileIdFullDirectoryInformation, TRUE, &FileNameStr, TRUE
);

The stream path is: \test.txt:testads:$DATA

I have tried this with and without the :$DATA and in both cases the
CreateFileW works fine but the NtQueryDirectoryFile returns C0000033
which
is OBJECT_NAME_INVALID. Notepad can open the stream.

Is NtQueryDirectoryFile supposed to work with alternative data streams?
If
not, then does this mean that the alternative streams do not have
attributes
such as create-time?


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Thanks. I was confusing files and streams. So there really aren’t many
attributes for streams. Just name and file-size.

“Tony Mason” wrote in message news:xxxxx@ntfsd…
NtQueryDirectoryFile works on directories, not files and not on streams.

The attributes apply to the file, not to the stream. There is no
separate set of timestamps per stream; when you query the file you’ll
get the size information for the default data stream.

If you want the information for the streams you need to use
IRP_MJ_QUERY_INFORMATION/FileStreamInformation.

Oh, and keep in mind: directories support streams as well…

And final caveat: we’re talking about the NTFS implementation of streams
here. There ARE other file systems that implement and support streams
(by that name or any other name…)

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
Sent: Wednesday, August 10, 2005 6:55 PM
To: ntfsd redirect
Subject: [ntfsd] NtQueryDirectoryFile with alternative data streams?

(If this is the wrong place to ask questions like this, can you please
direct me to the correct place?)

I have user code that is trying to open an alternative data stream and
get
FileIdFullDirectoryInformation. This is the code:

fileHandle = CreateFileW ( DirPath, GENERIC_READ,
FILE_SHARE_READ|FILE_SHARE_WRITE, NULL, OPEN_EXISTING,
FILE_FLAG_BACKUP_SEMANTICS, 0 );

status = NtQueryDirectoryFile( fileHandle, NULL, NULL, NULL, &ioStatus,
pbuf, bufSize, FileIdFullDirectoryInformation, TRUE, &FileNameStr, TRUE
);

The stream path is: \test.txt:testads:$DATA

I have tried this with and without the :$DATA and in both cases the
CreateFileW works fine but the NtQueryDirectoryFile returns C0000033
which
is OBJECT_NAME_INVALID. Notepad can open the stream.

Is NtQueryDirectoryFile supposed to work with alternative data streams?
If
not, then does this mean that the alternative streams do not have
attributes
such as create-time?


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Hmmm … compression format? Encryption??

“Mark Hahn” wrote in message news:xxxxx@ntfsd…
> Thanks. I was confusing files and streams. So there really aren’t many
> attributes for streams. Just name and file-size.
>
>
> “Tony Mason” wrote in message news:xxxxx@ntfsd…
> NtQueryDirectoryFile works on directories, not files and not on streams.
>
> The attributes apply to the file, not to the stream. There is no
> separate set of timestamps per stream; when you query the file you’ll
> get the size information for the default data stream.
>
> If you want the information for the streams you need to use
> IRP_MJ_QUERY_INFORMATION/FileStreamInformation.
>
> Oh, and keep in mind: directories support streams as well…
>
> And final caveat: we’re talking about the NTFS implementation of streams
> here. There ARE other file systems that implement and support streams
> (by that name or any other name…)
>
> Regards,
>
> Tony
>
> Tony Mason
> Consulting Partner
> OSR Open Systems Resources, Inc.
> http://www.osr.com
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
> Sent: Wednesday, August 10, 2005 6:55 PM
> To: ntfsd redirect
> Subject: [ntfsd] NtQueryDirectoryFile with alternative data streams?
>
> (If this is the wrong place to ask questions like this, can you please
> direct me to the correct place?)
>
> I have user code that is trying to open an alternative data stream and
> get
> FileIdFullDirectoryInformation. This is the code:
>
> fileHandle = CreateFileW ( DirPath, GENERIC_READ,
> FILE_SHARE_READ|FILE_SHARE_WRITE, NULL, OPEN_EXISTING,
> FILE_FLAG_BACKUP_SEMANTICS, 0 );
>
> status = NtQueryDirectoryFile( fileHandle, NULL, NULL, NULL, &ioStatus,
> pbuf, bufSize, FileIdFullDirectoryInformation, TRUE, &FileNameStr, TRUE
> );
>
> The stream path is: \test.txt:testads:$DATA
>
> I have tried this with and without the :$DATA and in both cases the
> CreateFileW works fine but the NtQueryDirectoryFile returns C0000033
> which
> is OBJECT_NAME_INVALID. Notepad can open the stream.
>
> Is NtQueryDirectoryFile supposed to work with alternative data streams?
> If
> not, then does this mean that the alternative streams do not have
> attributes
> such as create-time?
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@osr.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>

If I’m not mistaken, both apply to all streams on the file or directory.
It is not possible to selectively compress or encrypt streams (at least
in NTFS).

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-216850-
xxxxx@lists.osr.com] On Behalf Of Lyndon J Clarke
Sent: Thursday, August 11, 2005 3:35 AM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] NtQueryDirectoryFile with alternative data
streams?

Hmmm … compression format? Encryption??

“Mark Hahn” wrote in message news:xxxxx@ntfsd…
> > Thanks. I was confusing files and streams. So there really aren’t
many
> > attributes for streams. Just name and file-size.
> >
> >
> > “Tony Mason” wrote in message news:xxxxx@ntfsd…
> > NtQueryDirectoryFile works on directories, not files and not on
streams.
> >
> > The attributes apply to the file, not to the stream. There is no
> > separate set of timestamps per stream; when you query the file
you’ll
> > get the size information for the default data stream.
> >
> > If you want the information for the streams you need to use
> > IRP_MJ_QUERY_INFORMATION/FileStreamInformation.
> >
> > Oh, and keep in mind: directories support streams as well…
> >
> > And final caveat: we’re talking about the NTFS implementation of
streams
> > here. There ARE other file systems that implement and support
streams
> > (by that name or any other name…)
> >
> > Regards,
> >
> > Tony
> >
> > Tony Mason
> > Consulting Partner
> > OSR Open Systems Resources, Inc.
> > http://www.osr.com
> >
> >
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
> > Sent: Wednesday, August 10, 2005 6:55 PM
> > To: ntfsd redirect
> > Subject: [ntfsd] NtQueryDirectoryFile with alternative data streams?
> >
> > (If this is the wrong place to ask questions like this, can you
please
> > direct me to the correct place?)
> >
> > I have user code that is trying to open an alternative data stream
and
> > get
> > FileIdFullDirectoryInformation. This is the code:
> >
> > fileHandle = CreateFileW ( DirPath, GENERIC_READ,
> > FILE_SHARE_READ|FILE_SHARE_WRITE, NULL, OPEN_EXISTING,
> > FILE_FLAG_BACKUP_SEMANTICS, 0 );
> >
> > status = NtQueryDirectoryFile( fileHandle, NULL, NULL, NULL,
&ioStatus,
> > pbuf, bufSize, FileIdFullDirectoryInformation, TRUE, &FileNameStr,
TRUE
> > );
> >
> > The stream path is: \test.txt:testads:$DATA
> >
> > I have tried this with and without the :$DATA and in both cases the
> > CreateFileW works fine but the NtQueryDirectoryFile returns C0000033
> > which
> > is OBJECT_NAME_INVALID. Notepad can open the stream.
> >
> > Is NtQueryDirectoryFile supposed to work with alternative data
streams?
> > If
> > not, then does this mean that the alternative streams do not have
> > attributes
> > such as create-time?
> >
> >
> >
> > —
> > Questions? First check the IFS FAQ at
> > https://www.osronline.com/article.cfm?id=17
> >
> > You are currently subscribed to ntfsd as: xxxxx@osr.com
> > To unsubscribe send a blank email to
xxxxx@lists.osr.com
> >
> >
> >
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@timespring.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

Also, AFAIK encrypted files (NTFS EFS) do not have encrypted alternate data
streams. And, an alternate data stream may be SPARSE independent of other
streams.

/ted

-----Original Message-----
From: John Moore [mailto:xxxxx@timespring.com]
Sent: Thursday, August 11, 2005 11:58 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] NtQueryDirectoryFile with alternative data streams?

If I’m not mistaken, both apply to all streams on the file or directory. It
is not possible to selectively compress or encrypt streams (at least in
NTFS).

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-216850-
xxxxx@lists.osr.com] On Behalf Of Lyndon J Clarke
Sent: Thursday, August 11, 2005 3:35 AM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] NtQueryDirectoryFile with alternative data
streams?

Hmmm … compression format? Encryption??

“Mark Hahn” wrote in message news:xxxxx@ntfsd…
> > Thanks. I was confusing files and streams. So there really aren’t
many
> > attributes for streams. Just name and file-size.
> >
> >
> > “Tony Mason” wrote in message news:xxxxx@ntfsd…
> > NtQueryDirectoryFile works on directories, not files and not on
streams.
> >
> > The attributes apply to the file, not to the stream. There is no
> > separate set of timestamps per stream; when you query the file
you’ll
> > get the size information for the default data stream.
> >
> > If you want the information for the streams you need to use
> > IRP_MJ_QUERY_INFORMATION/FileStreamInformation.
> >
> > Oh, and keep in mind: directories support streams as well…
> >
> > And final caveat: we’re talking about the NTFS implementation of
streams
> > here. There ARE other file systems that implement and support
streams
> > (by that name or any other name…)
> >
> > Regards,
> >
> > Tony
> >
> > Tony Mason
> > Consulting Partner
> > OSR Open Systems Resources, Inc.
> > http://www.osr.com
> >
> >
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
> > Sent: Wednesday, August 10, 2005 6:55 PM
> > To: ntfsd redirect
> > Subject: [ntfsd] NtQueryDirectoryFile with alternative data streams?
> >
> > (If this is the wrong place to ask questions like this, can you
please
> > direct me to the correct place?)
> >
> > I have user code that is trying to open an alternative data stream
and
> > get
> > FileIdFullDirectoryInformation. This is the code:
> >
> > fileHandle = CreateFileW ( DirPath, GENERIC_READ,
> > FILE_SHARE_READ|FILE_SHARE_WRITE, NULL, OPEN_EXISTING,
> > FILE_FLAG_BACKUP_SEMANTICS, 0 );
> >
> > status = NtQueryDirectoryFile( fileHandle, NULL, NULL, NULL,
&ioStatus,
> > pbuf, bufSize, FileIdFullDirectoryInformation, TRUE, &FileNameStr,
TRUE
> > );
> >
> > The stream path is: \test.txt:testads:$DATA
> >
> > I have tried this with and without the :$DATA and in both cases the
> > CreateFileW works fine but the NtQueryDirectoryFile returns C0000033
> > which is OBJECT_NAME_INVALID. Notepad can open the stream.
> >
> > Is NtQueryDirectoryFile supposed to work with alternative data
streams?
> > If
> > not, then does this mean that the alternative streams do not have
> > attributes such as create-time?
> >
> >
> >
> > —
> > Questions? First check the IFS FAQ at
> > https://www.osronline.com/article.cfm?id=17
> >
> > You are currently subscribed to ntfsd as: xxxxx@osr.com
> > To unsubscribe send a blank email to
xxxxx@lists.osr.com
> >
> >
> >
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@timespring.com To
> unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

It’s been awhile since I looked at this but I think that alternate data
streams on encrypted files are encrypted but alternate data streams on
encrypted directories are not encrypted.

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-216921-
xxxxx@lists.osr.com] On Behalf Of Ted Hess
Sent: Thursday, August 11, 2005 11:27 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] NtQueryDirectoryFile with alternative data
streams?

Also, AFAIK encrypted files (NTFS EFS) do not have encrypted alternate
data
streams. And, an alternate data stream may be SPARSE independent of
other
streams.

/ted

-----Original Message-----
From: John Moore [mailto:xxxxx@timespring.com]
Sent: Thursday, August 11, 2005 11:58 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] NtQueryDirectoryFile with alternative data
streams?

If I’m not mistaken, both apply to all streams on the file or
directory.
It
is not possible to selectively compress or encrypt streams (at least
in
NTFS).

> -----Original Message-----
> From: xxxxx@lists.osr.com [mailto:bounce-216850-
> xxxxx@lists.osr.com] On Behalf Of Lyndon J Clarke
> Sent: Thursday, August 11, 2005 3:35 AM
> To: Windows File Systems Devs Interest List
> Subject: Re:[ntfsd] NtQueryDirectoryFile with alternative data
streams?
>
> Hmmm … compression format? Encryption??
>
> “Mark Hahn” wrote in message news:xxxxx@ntfsd…
> > > Thanks. I was confusing files and streams. So there really
aren’t
> many
> > > attributes for streams. Just name and file-size.
> > >
> > >
> > > “Tony Mason” wrote in message news:xxxxx@ntfsd…
> > > NtQueryDirectoryFile works on directories, not files and not on
> streams.
> > >
> > > The attributes apply to the file, not to the stream. There is no
> > > separate set of timestamps per stream; when you query the file
> you’ll
> > > get the size information for the default data stream.
> > >
> > > If you want the information for the streams you need to use
> > > IRP_MJ_QUERY_INFORMATION/FileStreamInformation.
> > >
> > > Oh, and keep in mind: directories support streams as well…
> > >
> > > And final caveat: we’re talking about the NTFS implementation of
> streams
> > > here. There ARE other file systems that implement and support
> streams
> > > (by that name or any other name…)
> > >
> > > Regards,
> > >
> > > Tony
> > >
> > > Tony Mason
> > > Consulting Partner
> > > OSR Open Systems Resources, Inc.
> > > http://www.osr.com
> > >
> > >
> > > -----Original Message-----
> > > From: xxxxx@lists.osr.com
> > > [mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
> > > Sent: Wednesday, August 10, 2005 6:55 PM
> > > To: ntfsd redirect
> > > Subject: [ntfsd] NtQueryDirectoryFile with alternative data
streams?
> > >
> > > (If this is the wrong place to ask questions like this, can you
> please
> > > direct me to the correct place?)
> > >
> > > I have user code that is trying to open an alternative data stream
> and
> > > get
> > > FileIdFullDirectoryInformation. This is the code:
> > >
> > > fileHandle = CreateFileW ( DirPath, GENERIC_READ,
> > > FILE_SHARE_READ|FILE_SHARE_WRITE, NULL, OPEN_EXISTING,
> > > FILE_FLAG_BACKUP_SEMANTICS, 0 );
> > >
> > > status = NtQueryDirectoryFile( fileHandle, NULL, NULL, NULL,
> &ioStatus,
> > > pbuf, bufSize, FileIdFullDirectoryInformation, TRUE, &FileNameStr,
> TRUE
> > > );
> > >
> > > The stream path is: \test.txt:testads:$DATA
> > >
> > > I have tried this with and without the :$DATA and in both cases
the
> > > CreateFileW works fine but the NtQueryDirectoryFile returns
C0000033
> > > which is OBJECT_NAME_INVALID. Notepad can open the stream.
> > >
> > > Is NtQueryDirectoryFile supposed to work with alternative data
> streams?
> > > If
> > > not, then does this mean that the alternative streams do not have
> > > attributes such as create-time?
> > >
> > >
> > >
> > > —
> > > Questions? First check the IFS FAQ at
> > > https://www.osronline.com/article.cfm?id=17
> > >
> > > You are currently subscribed to ntfsd as: xxxxx@osr.com
> > > To unsubscribe send a blank email to
> xxxxx@lists.osr.com
> > >
> > >
> > >
> >
> >
> >
> > —
> > Questions? First check the IFS FAQ at
> > https://www.osronline.com/article.cfm?id=17
> >
> > You are currently subscribed to ntfsd as: xxxxx@timespring.com To
> > unsubscribe send a blank email to xxxxx@lists.osr.com
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown lmsubst tag
argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@timespring.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

Microsoft - please please please document how your software is supposed to
behave :slight_smile:

“Mark Hahn” wrote in message news:xxxxx@ntfsd…
> (If this is the wrong place to ask questions like this, can you please
> direct me to the correct place?)
>
> I have user code that is trying to open an alternative data stream and get
> FileIdFullDirectoryInformation. This is the code:
>
> fileHandle = CreateFileW ( DirPath, GENERIC_READ,
> FILE_SHARE_READ|FILE_SHARE_WRITE, NULL, OPEN_EXISTING,
> FILE_FLAG_BACKUP_SEMANTICS, 0 );
>
> status = NtQueryDirectoryFile( fileHandle, NULL, NULL, NULL, &ioStatus,
> pbuf, bufSize, FileIdFullDirectoryInformation, TRUE, &FileNameStr, TRUE );
>
> The stream path is: \test.txt:testads:$DATA
>
> I have tried this with and without the :$DATA and in both cases the
> CreateFileW works fine but the NtQueryDirectoryFile returns C0000033 which
> is OBJECT_NAME_INVALID. Notepad can open the stream.
>
> Is NtQueryDirectoryFile supposed to work with alternative data streams?
> If not, then does this mean that the alternative streams do not have
> attributes such as create-time?
>
>

> Oh, and keep in mind: directories support streams as well…

Are you sure about this? None of the ADS viewer utilities I’ve downloaded
support directories. Also, when I run NtQueryInformationFile /
FileStreamInformation on a directory, I’m getting really strange behaviour.
It is returning the same streams that it returned from the last file I
called it on. I verified that when I removed the ADS from the file, it quit
returning it from the directory also.

“Tony Mason” wrote in message news:xxxxx@ntfsd…
NtQueryDirectoryFile works on directories, not files and not on streams.

The attributes apply to the file, not to the stream. There is no
separate set of timestamps per stream; when you query the file you’ll
get the size information for the default data stream.

If you want the information for the streams you need to use
IRP_MJ_QUERY_INFORMATION/FileStreamInformation.

Oh, and keep in mind: directories support streams as well…

And final caveat: we’re talking about the NTFS implementation of streams
here. There ARE other file systems that implement and support streams
(by that name or any other name…)

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
Sent: Wednesday, August 10, 2005 6:55 PM
To: ntfsd redirect
Subject: [ntfsd] NtQueryDirectoryFile with alternative data streams?

(If this is the wrong place to ask questions like this, can you please
direct me to the correct place?)

I have user code that is trying to open an alternative data stream and
get
FileIdFullDirectoryInformation. This is the code:

fileHandle = CreateFileW ( DirPath, GENERIC_READ,
FILE_SHARE_READ|FILE_SHARE_WRITE, NULL, OPEN_EXISTING,
FILE_FLAG_BACKUP_SEMANTICS, 0 );

status = NtQueryDirectoryFile( fileHandle, NULL, NULL, NULL, &ioStatus,
pbuf, bufSize, FileIdFullDirectoryInformation, TRUE, &FileNameStr, TRUE
);

The stream path is: \test.txt:testads:$DATA

I have tried this with and without the :$DATA and in both cases the
CreateFileW works fine but the NtQueryDirectoryFile returns C0000033
which
is OBJECT_NAME_INVALID. Notepad can open the stream.

Is NtQueryDirectoryFile supposed to work with alternative data streams?
If
not, then does this mean that the alternative streams do not have
attributes
such as create-time?


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

> None of the ADS viewer utilities I’ve downloaded support directories.

Try Ladislav’s FileTest - ir works a treat for me.

/rod

Mark

Doubleplussure that directories support named data streams and can confirm
dont see the sort of behaviour your report with
NtQueryInformationFile/FileStreamInformation … perhaps you need to have a
second look at your test code? If
the problem hasnt “just gone away” let us know and will mail you some
snippets which might help.

Cheers
Lydnon

“Mark Hahn” wrote in message news:xxxxx@ntfsd…
>> Oh, and keep in mind: directories support streams as well…
>
> Are you sure about this? None of the ADS viewer utilities I’ve downloaded
> support directories. Also, when I run NtQueryInformationFile /
> FileStreamInformation on a directory, I’m getting really strange
> behaviour. It is returning the same streams that it returned from the last
> file I called it on. I verified that when I removed the ADS from the
> file, it quit returning it from the directory also.
>
>
> “Tony Mason” wrote in message news:xxxxx@ntfsd…
> NtQueryDirectoryFile works on directories, not files and not on streams.
>
> The attributes apply to the file, not to the stream. There is no
> separate set of timestamps per stream; when you query the file you’ll
> get the size information for the default data stream.
>
> If you want the information for the streams you need to use
> IRP_MJ_QUERY_INFORMATION/FileStreamInformation.
>
> Oh, and keep in mind: directories support streams as well…
>
> And final caveat: we’re talking about the NTFS implementation of streams
> here. There ARE other file systems that implement and support streams
> (by that name or any other name…)
>
> Regards,
>
> Tony
>
> Tony Mason
> Consulting Partner
> OSR Open Systems Resources, Inc.
> http://www.osr.com
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
> Sent: Wednesday, August 10, 2005 6:55 PM
> To: ntfsd redirect
> Subject: [ntfsd] NtQueryDirectoryFile with alternative data streams?
>
> (If this is the wrong place to ask questions like this, can you please
> direct me to the correct place?)
>
> I have user code that is trying to open an alternative data stream and
> get
> FileIdFullDirectoryInformation. This is the code:
>
> fileHandle = CreateFileW ( DirPath, GENERIC_READ,
> FILE_SHARE_READ|FILE_SHARE_WRITE, NULL, OPEN_EXISTING,
> FILE_FLAG_BACKUP_SEMANTICS, 0 );
>
> status = NtQueryDirectoryFile( fileHandle, NULL, NULL, NULL, &ioStatus,
> pbuf, bufSize, FileIdFullDirectoryInformation, TRUE, &FileNameStr, TRUE
> );
>
> The stream path is: \test.txt:testads:$DATA
>
> I have tried this with and without the :$DATA and in both cases the
> CreateFileW works fine but the NtQueryDirectoryFile returns C0000033
> which
> is OBJECT_NAME_INVALID. Notepad can open the stream.
>
> Is NtQueryDirectoryFile supposed to work with alternative data streams?
> If
> not, then does this mean that the alternative streams do not have
> attributes
> such as create-time?
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@osr.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>

I figured out my problem with NtQueryInformationFile/FileStreamInformation.
My code only looked at the nextEntry field and that scheme always reports at
least one entry. In other words my code assumed all the information from
the call was contained in the buffer. Now I know that when there are no
data streams the buffer is left unchanged and the ioResult field tells
whether there is anything in the buffer or not. So looking at ioResult
fixed my problem.

“Lyndon J Clarke” wrote in message
news:xxxxx@ntfsd…
> Mark
>
> Doubleplussure that directories support named data streams and can confirm
> dont see the sort of behaviour your report with
> NtQueryInformationFile/FileStreamInformation … perhaps you need to have
> a second look at your test code? If
> the problem hasnt “just gone away” let us know and will mail you some
> snippets which might help.
>
> Cheers
> Lydnon
>
> “Mark Hahn” wrote in message news:xxxxx@ntfsd…
>>> Oh, and keep in mind: directories support streams as well…
>>
>> Are you sure about this? None of the ADS viewer utilities I’ve
>> downloaded support directories. Also, when I run NtQueryInformationFile
>> / FileStreamInformation on a directory, I’m getting really strange
>> behaviour. It is returning the same streams that it returned from the
>> last file I called it on. I verified that when I removed the ADS from
>> the file, it quit returning it from the directory also.
>>
>>
>> “Tony Mason” wrote in message news:xxxxx@ntfsd…
>> NtQueryDirectoryFile works on directories, not files and not on streams.
>>
>> The attributes apply to the file, not to the stream. There is no
>> separate set of timestamps per stream; when you query the file you’ll
>> get the size information for the default data stream.
>>
>> If you want the information for the streams you need to use
>> IRP_MJ_QUERY_INFORMATION/FileStreamInformation.
>>
>> Oh, and keep in mind: directories support streams as well…
>>
>> And final caveat: we’re talking about the NTFS implementation of streams
>> here. There ARE other file systems that implement and support streams
>> (by that name or any other name…)
>>
>> Regards,
>>
>> Tony
>>
>> Tony Mason
>> Consulting Partner
>> OSR Open Systems Resources, Inc.
>> http://www.osr.com
>>
>>
>> -----Original Message-----
>> From: xxxxx@lists.osr.com
>> [mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
>> Sent: Wednesday, August 10, 2005 6:55 PM
>> To: ntfsd redirect
>> Subject: [ntfsd] NtQueryDirectoryFile with alternative data streams?
>>
>> (If this is the wrong place to ask questions like this, can you please
>> direct me to the correct place?)
>>
>> I have user code that is trying to open an alternative data stream and
>> get
>> FileIdFullDirectoryInformation. This is the code:
>>
>> fileHandle = CreateFileW ( DirPath, GENERIC_READ,
>> FILE_SHARE_READ|FILE_SHARE_WRITE, NULL, OPEN_EXISTING,
>> FILE_FLAG_BACKUP_SEMANTICS, 0 );
>>
>> status = NtQueryDirectoryFile( fileHandle, NULL, NULL, NULL, &ioStatus,
>> pbuf, bufSize, FileIdFullDirectoryInformation, TRUE, &FileNameStr, TRUE
>> );
>>
>> The stream path is: \test.txt:testads:$DATA
>>
>> I have tried this with and without the :$DATA and in both cases the
>> CreateFileW works fine but the NtQueryDirectoryFile returns C0000033
>> which
>> is OBJECT_NAME_INVALID. Notepad can open the stream.
>>
>> Is NtQueryDirectoryFile supposed to work with alternative data streams?
>> If
>> not, then does this mean that the alternative streams do not have
>> attributes
>> such as create-time?
>>
>>
>>
>> —
>> Questions? First check the IFS FAQ at
>> https://www.osronline.com/article.cfm?id=17
>>
>> You are currently subscribed to ntfsd as: xxxxx@osr.com
>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>>
>
>
>

Mark - Well! I am sure you will agree the documentation does make quite
clear that in this particular call IoStatus->Information contains the number
of byte used in the output buffer and that can/could/should/must be used to
interpret the output. - Cheers, Lyndon

“Mark Hahn” wrote in message news:xxxxx@ntfsd…
>I figured out my problem with NtQueryInformationFile/FileStreamInformation.
>My code only looked at the nextEntry field and that scheme always reports
>at least one entry. In other words my code assumed all the information
>from the call was contained in the buffer. Now I know that when there are
>no data streams the buffer is left unchanged and the ioResult field tells
>whether there is anything in the buffer or not. So looking at ioResult
>fixed my problem.
>
> “Lyndon J Clarke” wrote in message
> news:xxxxx@ntfsd…
>> Mark
>>
>> Doubleplussure that directories support named data streams and can
>> confirm dont see the sort of behaviour your report with
>> NtQueryInformationFile/FileStreamInformation … perhaps you need to have
>> a second look at your test code? If
>> the problem hasnt “just gone away” let us know and will mail you some
>> snippets which might help.
>>
>> Cheers
>> Lydnon
>>
>> “Mark Hahn” wrote in message news:xxxxx@ntfsd…
>>>> Oh, and keep in mind: directories support streams as well…
>>>
>>> Are you sure about this? None of the ADS viewer utilities I’ve
>>> downloaded support directories. Also, when I run NtQueryInformationFile
>>> / FileStreamInformation on a directory, I’m getting really strange
>>> behaviour. It is returning the same streams that it returned from the
>>> last file I called it on. I verified that when I removed the ADS from
>>> the file, it quit returning it from the directory also.
>>>
>>>
>>> “Tony Mason” wrote in message news:xxxxx@ntfsd…
>>> NtQueryDirectoryFile works on directories, not files and not on streams.
>>>
>>> The attributes apply to the file, not to the stream. There is no
>>> separate set of timestamps per stream; when you query the file you’ll
>>> get the size information for the default data stream.
>>>
>>> If you want the information for the streams you need to use
>>> IRP_MJ_QUERY_INFORMATION/FileStreamInformation.
>>>
>>> Oh, and keep in mind: directories support streams as well…
>>>
>>> And final caveat: we’re talking about the NTFS implementation of streams
>>> here. There ARE other file systems that implement and support streams
>>> (by that name or any other name…)
>>>
>>> Regards,
>>>
>>> Tony
>>>
>>> Tony Mason
>>> Consulting Partner
>>> OSR Open Systems Resources, Inc.
>>> http://www.osr.com
>>>
>>>
>>> -----Original Message-----
>>> From: xxxxx@lists.osr.com
>>> [mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
>>> Sent: Wednesday, August 10, 2005 6:55 PM
>>> To: ntfsd redirect
>>> Subject: [ntfsd] NtQueryDirectoryFile with alternative data streams?
>>>
>>> (If this is the wrong place to ask questions like this, can you please
>>> direct me to the correct place?)
>>>
>>> I have user code that is trying to open an alternative data stream and
>>> get
>>> FileIdFullDirectoryInformation. This is the code:
>>>
>>> fileHandle = CreateFileW ( DirPath, GENERIC_READ,
>>> FILE_SHARE_READ|FILE_SHARE_WRITE, NULL, OPEN_EXISTING,
>>> FILE_FLAG_BACKUP_SEMANTICS, 0 );
>>>
>>> status = NtQueryDirectoryFile( fileHandle, NULL, NULL, NULL, &ioStatus,
>>> pbuf, bufSize, FileIdFullDirectoryInformation, TRUE, &FileNameStr, TRUE
>>> );
>>>
>>> The stream path is: \test.txt:testads:$DATA
>>>
>>> I have tried this with and without the :$DATA and in both cases the
>>> CreateFileW works fine but the NtQueryDirectoryFile returns C0000033
>>> which
>>> is OBJECT_NAME_INVALID. Notepad can open the stream.
>>>
>>> Is NtQueryDirectoryFile supposed to work with alternative data streams?
>>> If
>>> not, then does this mean that the alternative streams do not have
>>> attributes
>>> such as create-time?
>>>
>>>
>>>
>>> —
>>> Questions? First check the IFS FAQ at
>>> https://www.osronline.com/article.cfm?id=17
>>>
>>> You are currently subscribed to ntfsd as: xxxxx@osr.com
>>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>>
>>>
>>
>>
>>
>
>
>

I find for NTFS least in W2K3 SP1:

  • streams can be compressed/decompressed indepent of one another and appear
    to have own compression “attribute”;
  • streams can be set sparse independent of one another and appear to have
    own sparse “attribute”;
  • streams cannot be encrypted/decrypted independent of another
  • at least for a fact I see EncryptFile()/DecryptFile() fail when applied
    to a named stream.

“Tony Mason” wrote in message news:xxxxx@ntfsd…
NtQueryDirectoryFile works on directories, not files and not on streams.

The attributes apply to the file, not to the stream. There is no
separate set of timestamps per stream; when you query the file you’ll
get the size information for the default data stream.

If you want the information for the streams you need to use
IRP_MJ_QUERY_INFORMATION/FileStreamInformation.

Oh, and keep in mind: directories support streams as well…

And final caveat: we’re talking about the NTFS implementation of streams
here. There ARE other file systems that implement and support streams
(by that name or any other name…)

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
Sent: Wednesday, August 10, 2005 6:55 PM
To: ntfsd redirect
Subject: [ntfsd] NtQueryDirectoryFile with alternative data streams?

(If this is the wrong place to ask questions like this, can you please
direct me to the correct place?)

I have user code that is trying to open an alternative data stream and
get
FileIdFullDirectoryInformation. This is the code:

fileHandle = CreateFileW ( DirPath, GENERIC_READ,
FILE_SHARE_READ|FILE_SHARE_WRITE, NULL, OPEN_EXISTING,
FILE_FLAG_BACKUP_SEMANTICS, 0 );

status = NtQueryDirectoryFile( fileHandle, NULL, NULL, NULL, &ioStatus,
pbuf, bufSize, FileIdFullDirectoryInformation, TRUE, &FileNameStr, TRUE
);

The stream path is: \test.txt:testads:$DATA

I have tried this with and without the :$DATA and in both cases the
CreateFileW works fine but the NtQueryDirectoryFile returns C0000033
which
is OBJECT_NAME_INVALID. Notepad can open the stream.

Is NtQueryDirectoryFile supposed to work with alternative data streams?
If
not, then does this mean that the alternative streams do not have
attributes
such as create-time?


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Furthermore …

If a file is “encrypted” meaning GetFileAttributes returns
FILE_ATTRIBUTE_ENCRYPTED bit set then same bit set is returned for all
streams of the file. If a new stream is created for an existing file,
calling CreateFile with FILE_ATTRIBUTE_ENCRYPTED set the bit is not
operative; if however the file does not exist then the bit is operative.

If a directoty is “encrypted” meaning as above then the bit is
unlikewise(?!) returned unset for all streams of the directory. If a new
stream is created for an existing directory as above then the bit is
likewise not operative.

I have not found mechanism to create a stream for a directory that does not
exist; which is same as saying that if the “base” object doesnt exist then I
havent found a way to get a directory created instead of a file as an
indirect result of creating a named data stream. If someone out there knows
how to do this I would appreciate if you could let us know; perhaps I have
missed something obvious (again) :wink:

Cheers
Lyndon

“Lyndon J Clarke” wrote in message
news:xxxxx@ntfsd…
> Microsoft - please please please document how your software is supposed to
> behave :slight_smile:
>
> “Mark Hahn” wrote in message news:xxxxx@ntfsd…
>> (If this is the wrong place to ask questions like this, can you please
>> direct me to the correct place?)
>>
>> I have user code that is trying to open an alternative data stream and
>> get FileIdFullDirectoryInformation. This is the code:
>>
>> fileHandle = CreateFileW ( DirPath, GENERIC_READ,
>> FILE_SHARE_READ|FILE_SHARE_WRITE, NULL, OPEN_EXISTING,
>> FILE_FLAG_BACKUP_SEMANTICS, 0 );
>>
>> status = NtQueryDirectoryFile( fileHandle, NULL, NULL, NULL, &ioStatus,
>> pbuf, bufSize, FileIdFullDirectoryInformation, TRUE, &FileNameStr,
>> TRUE );
>>
>> The stream path is: \test.txt:testads:$DATA
>>
>> I have tried this with and without the :$DATA and in both cases the
>> CreateFileW works fine but the NtQueryDirectoryFile returns C0000033
>> which is OBJECT_NAME_INVALID. Notepad can open the stream.
>>
>> Is NtQueryDirectoryFile supposed to work with alternative data streams?
>> If not, then does this mean that the alternative streams do not have
>> attributes such as create-time?
>>
>>
>
>
>

Directories don’t have data attribute. All named attributes for
files/records can have multiple instances and $DATA is an attribute which is
applicable to file entries and when you create multiple streams of a file,
you are essentially creating named $DATA attribute (unnamed $DATA attribute
is the default stream and is accessed when you just specify file path).
Compression and sparse behavior is applicable per stream basis while
encryption is for a file/directory.
I guess your NtQueryDirectoryFile is failing because you are not passing
handle to a directory. Are you using a valid information class? (Is
FileIdFullDirectoryInformation a new class?) You may want to use
NtQueryInformationFile with a handle to File:stream.

Thx
P

-----Original Message-----
From: Lyndon J Clarke [mailto:xxxxx@neverfailgroup.com]
Sent: Thursday, August 18, 2005 10:43 AM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] NtQueryDirectoryFile with alternative data streams?

Furthermore …

If a file is “encrypted” meaning GetFileAttributes returns
FILE_ATTRIBUTE_ENCRYPTED bit set then same bit set is returned for all
streams of the file. If a new stream is created for an existing file,
calling CreateFile with FILE_ATTRIBUTE_ENCRYPTED set the bit is not
operative; if however the file does not exist then the bit is operative.

If a directoty is “encrypted” meaning as above then the bit is
unlikewise(?!) returned unset for all streams of the directory. If a new
stream is created for an existing directory as above then the bit is
likewise not operative.

I have not found mechanism to create a stream for a directory that does not
exist; which is same as saying that if the “base” object doesnt exist then
I
havent found a way to get a directory created instead of a file as an
indirect result of creating a named data stream. If someone out there knows
how to do this I would appreciate if you could let us know; perhaps I have
missed something obvious (again) :wink:

Cheers
Lyndon

“Lyndon J Clarke” wrote in message
>news:xxxxx@ntfsd…
>> Microsoft - please please please document how your software is supposed
>to
>> behave :slight_smile:
>>
>> “Mark Hahn” wrote in message news:xxxxx@ntfsd…
>>> (If this is the wrong place to ask questions like this, can you please
>>> direct me to the correct place?)
>>>
>>> I have user code that is trying to open an alternative data stream and
>>> get FileIdFullDirectoryInformation. This is the code:
>>>
>>> fileHandle = CreateFileW ( DirPath, GENERIC_READ,
>>> FILE_SHARE_READ|FILE_SHARE_WRITE, NULL, OPEN_EXISTING,
>>> FILE_FLAG_BACKUP_SEMANTICS, 0 );
>>>
>>> status = NtQueryDirectoryFile( fileHandle, NULL, NULL, NULL, &ioStatus,
>>> pbuf, bufSize, FileIdFullDirectoryInformation, TRUE, &FileNameStr,
>>> TRUE );
>>>
>>> The stream path is: \test.txt:testads:$DATA
>>>
>>> I have tried this with and without the :$DATA and in both cases the
>>> CreateFileW works fine but the NtQueryDirectoryFile returns C0000033
>>> which is OBJECT_NAME_INVALID. Notepad can open the stream.
>>>
>>> Is NtQueryDirectoryFile supposed to work with alternative data streams?
>>> If not, then does this mean that the alternative streams do not have
>>> attributes such as create-time?
>>>
>>>
>>
>>
>>
>
>
>
>—
>Questions? First check the IFS FAQ at
>https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: xxxxx@emc.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com