Rename Target File Name Is Not Normalized In Vista

NTFSD
1

I observed a case that the rename target file name is not normalized in
Vista.
The member FileName of the structure FILE_RENAME_INFORMATION contains
the string like below.

\SystemRoot\WinSxS\Manifests\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.42_none_dc990e4797f81af1.manifest

If you interpret SystemRoot as C:\Windows it seems to be understandable.
I observed it during the installation of Office 2007.

My questions are:
(1) I heard that the rename target file name never contains a symblic
link like this.
Should I think it’s no longer true in Vista?
(2) How can I differentiate it from the real directory?
You can create the directory named SystemRoot.

Thanks in advance.
Ichir Akimoto

2

Where did you hear a target name never contains a symbolic link ? You can use FltGetDestinationFileNameInformation routine to construct a normalized full destination path name for a file or directory that is being renamed. If you need to get this in a postoperation callback routine for IRP_MJ_CREATE or IRP_MJ_SET_INFORMATION you should use get the tunneled file name using FltGetTunneledName.

/Daniel

“Ichiro Akimoto” wrote in message news:xxxxx@ntfsd…
>I observed a case that the rename target file name is not normalized in
> Vista.
> The member FileName of the structure FILE_RENAME_INFORMATION contains
> the string like below.
>
> \SystemRoot\WinSxS\Manifests\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.42_none_dc990e4797f81af1.manifest
>
> If you interpret SystemRoot as C:\Windows it seems to be understandable.
> I observed it during the installation of Office 2007.
>
> My questions are:
> (1) I heard that the rename target file name never contains a symblic
> link like this.
> Should I think it’s no longer true in Vista?
> (2) How can I differentiate it from the real directory?
> You can create the directory named SystemRoot.
>
> Thanks in advance.
> Ichir Akimoto
>
>

3

Thank you Daniel.

Although my concern is a legacy filter,
Your suggestion reminded me that the workaround is
“Mimic what FltGetDestinationFileNameInformation does”.

Ichir Akimoto