RE: SPAM-LOW: Re:NtQueryDirectoryFile with alternative data streams?

OSR_Community_User · August 12, 2005, 5:45pm

[D:] echo Directories support streams. >d::foo

[D:] more < d::foo
Directories support streams.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
Sent: Friday, August 12, 2005 5:27 PM
To: Windows File Systems Devs Interest List
Subject: SPAM-LOW: Re:[ntfsd] NtQueryDirectoryFile with alternative data
streams?

Oh, and keep in mind: directories support streams as well…

Are you sure about this? None of the ADS viewer utilities I’ve downloaded
support directories. Also, when I run NtQueryInformationFile /
FileStreamInformation on a directory, I’m getting really strange behaviour.
It is returning the same streams that it returned from the last file I
called it on. I verified that when I removed the ADS from the file, it quit
returning it from the directory also.

“Tony Mason” wrote in message news:xxxxx@ntfsd…
NtQueryDirectoryFile works on directories, not files and not on streams.

The attributes apply to the file, not to the stream. There is no separate
set of timestamps per stream; when you query the file you’ll get the size
information for the default data stream.

If you want the information for the streams you need to use
IRP_MJ_QUERY_INFORMATION/FileStreamInformation.

Oh, and keep in mind: directories support streams as well…

And final caveat: we’re talking about the NTFS implementation of streams
here. There ARE other file systems that implement and support streams (by
that name or any other name…)

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
Sent: Wednesday, August 10, 2005 6:55 PM
To: ntfsd redirect
Subject: [ntfsd] NtQueryDirectoryFile with alternative data streams?

(If this is the wrong place to ask questions like this, can you please
direct me to the correct place?)

I have user code that is trying to open an alternative data stream and get
FileIdFullDirectoryInformation. This is the code:

fileHandle = CreateFileW ( DirPath, GENERIC_READ,
FILE_SHARE_READ|FILE_SHARE_WRITE, NULL, OPEN_EXISTING,
FILE_FLAG_BACKUP_SEMANTICS, 0 );

status = NtQueryDirectoryFile( fileHandle, NULL, NULL, NULL, &ioStatus,
pbuf, bufSize, FileIdFullDirectoryInformation, TRUE, &FileNameStr, TRUE );

The stream path is: \test.txt:testads:$DATA

I have tried this with and without the :$DATA and in both cases the
CreateFileW works fine but the NtQueryDirectoryFile returns C0000033 which
is OBJECT_NAME_INVALID. Notepad can open the stream.

Is NtQueryDirectoryFile supposed to work with alternative data streams?
If
not, then does this mean that the alternative streams do not have attributes
such as create-time?

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com To unsubscribe send
a blank email to xxxxx@lists.osr.com

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@stonestreetone.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

Mark_Hahn · August 13, 2005, 3:19pm

Yes, that does seem to give some evidence that directories support streams.

I found my problem. I wasn’t looking at ioResult. As far as most utilities
not including directories, well, you cannot account for bad software.

My code now supports streams on directories, even though I doubt any
application uses it.

“Arlie Davis” wrote in message
news:xxxxx@ntfsd…
> [D:] echo Directories support streams. >d::foo
>
> [D:] more < d::foo
> Directories support streams.
>
>
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
> Sent: Friday, August 12, 2005 5:27 PM
> To: Windows File Systems Devs Interest List
> Subject: SPAM-LOW: Re:[ntfsd] NtQueryDirectoryFile with alternative data
> streams?
>
>> Oh, and keep in mind: directories support streams as well…
>
> Are you sure about this? None of the ADS viewer utilities I’ve downloaded
> support directories. Also, when I run NtQueryInformationFile /
> FileStreamInformation on a directory, I’m getting really strange
> behaviour.
> It is returning the same streams that it returned from the last file I
> called it on. I verified that when I removed the ADS from the file, it
> quit
> returning it from the directory also.
>
>
> “Tony Mason” wrote in message news:xxxxx@ntfsd…
> NtQueryDirectoryFile works on directories, not files and not on streams.
>
> The attributes apply to the file, not to the stream. There is no separate
> set of timestamps per stream; when you query the file you’ll get the size
> information for the default data stream.
>
> If you want the information for the streams you need to use
> IRP_MJ_QUERY_INFORMATION/FileStreamInformation.
>
> Oh, and keep in mind: directories support streams as well…
>
> And final caveat: we’re talking about the NTFS implementation of streams
> here. There ARE other file systems that implement and support streams (by
> that name or any other name…)
>
> Regards,
>
> Tony
>
> Tony Mason
> Consulting Partner
> OSR Open Systems Resources, Inc.
> http://www.osr.com
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
> Sent: Wednesday, August 10, 2005 6:55 PM
> To: ntfsd redirect
> Subject: [ntfsd] NtQueryDirectoryFile with alternative data streams?
>
> (If this is the wrong place to ask questions like this, can you please
> direct me to the correct place?)
>
> I have user code that is trying to open an alternative data stream and get
> FileIdFullDirectoryInformation. This is the code:
>
> fileHandle = CreateFileW ( DirPath, GENERIC_READ,
> FILE_SHARE_READ|FILE_SHARE_WRITE, NULL, OPEN_EXISTING,
> FILE_FLAG_BACKUP_SEMANTICS, 0 );
>
> status = NtQueryDirectoryFile( fileHandle, NULL, NULL, NULL, &ioStatus,
> pbuf, bufSize, FileIdFullDirectoryInformation, TRUE, &FileNameStr, TRUE );
>
> The stream path is: \test.txt:testads:$DATA
>
> I have tried this with and without the :$DATA and in both cases the
> CreateFileW works fine but the NtQueryDirectoryFile returns C0000033 which
> is OBJECT_NAME_INVALID. Notepad can open the stream.
>
> Is NtQueryDirectoryFile supposed to work with alternative data streams?
> If
> not, then does this mean that the alternative streams do not have
> attributes
> such as create-time?
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@osr.com To unsubscribe
> send
> a blank email to xxxxx@lists.osr.com
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@stonestreetone.com To
> unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
>

OSR_Community_User · August 13, 2005, 3:48pm

Having written software that uses streams on directories when present, I
can attest to the fact that such do exist. Indeed, streams on
directories are at LEAST as valuable as streams on files, if not moreso.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
Sent: Saturday, August 13, 2005 3:19 PM
To: ntfsd redirect
Subject: Re:[ntfsd] SPAM-LOW: Re:NtQueryDirectoryFile with alternative
data streams?

Yes, that does seem to give some evidence that directories support
streams.

I found my problem. I wasn’t looking at ioResult. As far as most
utilities
not including directories, well, you cannot account for bad software.

My code now supports streams on directories, even though I doubt any
application uses it.

“Arlie Davis” wrote in message
news:xxxxx@ntfsd…
> [D:] echo Directories support streams. >d::foo
>
> [D:] more < d::foo
> Directories support streams.
>
>
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
> Sent: Friday, August 12, 2005 5:27 PM
> To: Windows File Systems Devs Interest List
> Subject: SPAM-LOW: Re:[ntfsd] NtQueryDirectoryFile with alternative
data
> streams?
>
>> Oh, and keep in mind: directories support streams as well…
>
> Are you sure about this? None of the ADS viewer utilities I’ve
downloaded
> support directories. Also, when I run NtQueryInformationFile /
> FileStreamInformation on a directory, I’m getting really strange
> behaviour.
> It is returning the same streams that it returned from the last file I
> called it on. I verified that when I removed the ADS from the file,
it
> quit
> returning it from the directory also.
>
>
> “Tony Mason” wrote in message news:xxxxx@ntfsd…
> NtQueryDirectoryFile works on directories, not files and not on
streams.
>
> The attributes apply to the file, not to the stream. There is no
separate
> set of timestamps per stream; when you query the file you’ll get the
size
> information for the default data stream.
>
> If you want the information for the streams you need to use
> IRP_MJ_QUERY_INFORMATION/FileStreamInformation.
>
> Oh, and keep in mind: directories support streams as well…
>
> And final caveat: we’re talking about the NTFS implementation of
streams
> here. There ARE other file systems that implement and support streams
(by
> that name or any other name…)
>
> Regards,
>
> Tony
>
> Tony Mason
> Consulting Partner
> OSR Open Systems Resources, Inc.
> http://www.osr.com
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
> Sent: Wednesday, August 10, 2005 6:55 PM
> To: ntfsd redirect
> Subject: [ntfsd] NtQueryDirectoryFile with alternative data streams?
>
> (If this is the wrong place to ask questions like this, can you please
> direct me to the correct place?)
>
> I have user code that is trying to open an alternative data stream and
get
> FileIdFullDirectoryInformation. This is the code:
>
> fileHandle = CreateFileW ( DirPath, GENERIC_READ,
> FILE_SHARE_READ|FILE_SHARE_WRITE, NULL, OPEN_EXISTING,
> FILE_FLAG_BACKUP_SEMANTICS, 0 );
>
> status = NtQueryDirectoryFile( fileHandle, NULL, NULL, NULL,
&ioStatus,
> pbuf, bufSize, FileIdFullDirectoryInformation, TRUE, &FileNameStr,
TRUE );
>
> The stream path is: \test.txt:testads:$DATA
>
> I have tried this with and without the :$DATA and in both cases the
> CreateFileW works fine but the NtQueryDirectoryFile returns C0000033
which
> is OBJECT_NAME_INVALID. Notepad can open the stream.
>
> Is NtQueryDirectoryFile supposed to work with alternative data
streams?
> If
> not, then does this mean that the alternative streams do not have
> attributes
> such as create-time?
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@osr.com To unsubscribe

> send
> a blank email to xxxxx@lists.osr.com
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@stonestreetone.com To
> unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
>

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com