NtQueryInformationFile

NTFSD
1

Hello,

I have a problem with date returned by NtQueryDirectoryFile. My application does the following:
1… Opens directory.
DesiredAccess: SYNCHRONIZE | FILE_READ_DATA
FileAttributes: FILE_ATTRIBUTE_NORMAL
ShareAccess: FILE_SHARE_READ | FILE_SHARE_WRITE
CreateDisposition: FILE_OPEN
CreateOptions: FILE_DIRECTORY_FILE

2… Calls NtQueryDirectoryFile(
FileInformationClass: FileBothDirectoryInformation
ReturnSingleEntry: TRUE
FileName: “*”
RestartScan: TRUE

3… Repeat calling NtQueryDirectoryFile until all directory entries will be retrieved
FileInformationClass: FileBothDirectoryInformation
ReturnSingleEntry: FALSE
FileName: “*”
RestartScan: FALSE

4… Then I change FileName to name of a file from this directory. Let’s say “a.txt” and rescan the directory (using the same handle) from the beginning.
FileInformationClass: FileBothDirectoryInformation
ReturnSingleEntry: TRUE
FileName: “a.txt”
RestartScan: TRUE

5… But instead of “a.txt” or STATUS_NO_MORE_FILES or STATUS_NO_SUCH_FILE NtQueryDirectoryFile returns the same data I got while scanned using “*” FileName, i.e. changing of FileName has no effect!

6… If I continue calling the routine
FileInformationClass: FileBothDirectoryInformation
ReturnSingleEntry: FALSE
FileName: “a.txt”
RestartScan: FALSE
I’ll get the rest of directory entries.
What did I do wrong?

Best regards,
Alexey.

2

Hello,

If I understand correctly, this would be expected behaviour on NTFS.

NTFS does not honour reading directories based on either the Index number of the directory entry (Index can be specified if you generate your own QueryDirectory IRP) or the filename.

If you run your code against a FAT partition, I believe the filename based query would result in to expected output as the FAT FSD uses the filename input and does the right thing.

Regards,

Manish

Alexey Pakhunov wrote:
Hello,

I have a problem with date returned by NtQueryDirectoryFile. My application does the following:

Opens directory.
DesiredAccess: SYNCHRONIZE | FILE_READ_DATA
FileAttributes: FILE_ATTRIBUTE_NORMAL
ShareAccess: FILE_SHARE_READ | FILE_SHARE_WRITE
CreateDisposition: FILE_OPEN
CreateOptions: FILE_DIRECTORY_FILE

Calls NtQueryDirectoryFile(
FileInformationClass: FileBothDirectoryInformation
ReturnSingleEntry: TRUE
FileName: “"
RestartScan: TRUE

Repeat calling NtQueryDirectoryFile until all directory entries will be retrieved
FileInformationClass: FileBothDirectoryInformation
ReturnSingleEntry: FALSE
FileName: "”
RestartScan: FALSE

Then I change FileName to name of a file from this directory. Let’s say “a.txt” and rescan the directory (using the same handle) from the beginning.
FileInformationClass: FileBothDirectoryInformation
ReturnSingleEntry: TRUE
FileName: “a.txt”
RestartScan: TRUE

But instead of “a.txt” or STATUS_NO_MORE_FILES or STATUS_NO_SUCH_FILE NtQueryDirectoryFile returns the same data I got while scanned using “*” FileName, i.e. changing of FileName has no effect!

If I continue calling the routine
FileInformationClass: FileBothDirectoryInformation
ReturnSingleEntry: FALSE
FileName: “a.txt”
RestartScan: FALSE
I’ll get the rest of directory entries.
What did I do wrong?

Best regards,
Alexey.
—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@yahoo.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

---------------------------------
Do you Yahoo!?
Friends. Fun. Try the all-new Yahoo! Messenger

3

Hello,

Actually I tried FAT, FAT32 and NTFS and got the same result. FileName is ignored in the second NtQueryInformationFile call having RestartScan == TRUE.

Best regards,
Alexey.
----- Original Message -----
From: Manish Apte
To: Windows File Systems Devs Interest List
Sent: Wednesday, June 02, 2004 5:52 PM
Subject: Re: [ntfsd] NtQueryInformationFile

Hello,

If I understand correctly, this would be expected behaviour on NTFS.

NTFS does not honour reading directories based on either the Index number of the directory entry (Index can be specified if you generate your own QueryDirectory IRP) or the filename.

If you run your code against a FAT partition, I believe the filename based query would result in to expected output as the FAT FSD uses the filename input and does the right thing.

Regards,

Manish

Alexey Pakhunov wrote:
Hello,

I have a problem with date returned by NtQueryDirectoryFile. My application does the following:
1… Opens directory.
DesiredAccess: SYNCHRONIZE | FILE_READ_DATA
FileAttributes: FILE_ATTRIBUTE_NORMAL
ShareAccess: FILE_SHARE_READ | FILE_SHARE_WRITE
CreateDisposition: FILE_OPEN
CreateOptions: FILE_DIRECTORY_FILE

2… Calls NtQueryDirectoryFile(
FileInformationClass: FileBothDirectoryInformation
ReturnSingleEntry: TRUE
FileName: “"
RestartScan: TRUE

3… Repeat calling NtQueryDirectoryFile until all directory entries will be retrieved
FileInformationClass: FileBothDirectoryInformation
ReturnSingleEntry: FALSE
FileName: "”
RestartScan: FALSE

4… Then I change FileName to name of a file from this directory. Let’s say “a.txt” and rescan the directory (using the same handle) from the beginning.
FileInformationClass: FileBothDirectoryInformation
ReturnSingleEntry: TRUE
FileName: “a.txt”
RestartScan: TRUE

5… But instead of “a.txt” or STATUS_NO_MORE_FILES or STATUS_NO_SUCH_FILE NtQueryDirectoryFile returns the same data I got while scanned using “*” FileName, i.e. changing of FileName has no effect!

6… If I continue calling the routine
FileInformationClass: FileBothDirectoryInformation
ReturnSingleEntry: FALSE
FileName: “a.txt”
RestartScan: FALSE
I’ll get the rest of directory entries.
What did I do wrong?

Best regards,
Alexey.
—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@yahoo.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

------------------------------------------------------------------------------
Do you Yahoo!?
Friends. Fun. Try the all-new Yahoo! Messenger — Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17 You are currently subscribed to ntfsd as: xxxxx@cooldev.com To unsubscribe send a blank email to xxxxx@lists.osr.com

4

You can’t change name “on the fly”. Structures that are backing up dir
enum are allocated per-handle and are initialized at the first dir
control. Look at fastfat source from IFS Kit.
Although it’s not a requirement (I think) to ignore later name changes
but that’s how it is implemented in FAT/NTFS. After all this matches the
semantics of Win32 FindFirst/FindNextFile.

-----Original Message-----
From: Alexey Pakhunov [mailto:xxxxx@cooldev.com]
Sent: Wednesday, June 02, 2004 7:01 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] NtQueryInformationFile

Hello,

I have a problem with date returned by NtQueryDirectoryFile. My
application does the following:

  1. Opens directory.
    DesiredAccess: SYNCHRONIZE | FILE_READ_DATA
    FileAttributes: FILE_ATTRIBUTE_NORMAL
    ShareAccess: FILE_SHARE_READ | FILE_SHARE_WRITE
    CreateDisposition: FILE_OPEN
    CreateOptions: FILE_DIRECTORY_FILE
  2. Calls NtQueryDirectoryFile(
    FileInformationClass: FileBothDirectoryInformation
    ReturnSingleEntry: TRUE
    FileName: “*”
    RestartScan: TRUE
  3. Repeat calling NtQueryDirectoryFile until all directory entries
    will be retrieved
    FileInformationClass: FileBothDirectoryInformation
    ReturnSingleEntry: FALSE
    FileName: “*”
    RestartScan: FALSE
  4. Then I change FileName to name of a file from this directory.
    Let’s say “a.txt” and rescan the directory (using the same handle) from
    the beginning.
    FileInformationClass: FileBothDirectoryInformation
    ReturnSingleEntry: TRUE
    FileName: “a.txt”
    RestartScan: TRUE
  5. But instead of “a.txt” or STATUS_NO_MORE_FILES or
    STATUS_NO_SUCH_FILE NtQueryDirectoryFile returns the same data I got
    while scanned using “*” FileName, i.e. changing of FileName has no
    effect!
  6. If I continue calling the routine
    FileInformationClass: FileBothDirectoryInformation
    ReturnSingleEntry: FALSE
    FileName: “a.txt”
    RestartScan: FALSE
    I’ll get the rest of directory entries.
    What did I do wrong?

Best regards,
Alexey.

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as:
xxxxx@borland.com
To unsubscribe send a blank email to xxxxx@lists.osr.com