Safe way to detect file truncation or extension

NTFSD
1

Hi!

Is there any safe way to detect when an app is truncating a file or
extending it without writing (using SetFilePointer + SetEndOfFile)?

Debugging with WinDbg, I’ve noted that while creating a file with few
bytes using notepad, the pEndOfFileInfo->EndOfFile in
IRP_MJ_SET_INFORMATION is 0x1000 (4k). I didn’t know that the memory
page size would affect the file size… And the IRP_NO_CACHE flag is
never on while setting the end of file.

Thanks,

Strauss

2

Truncation may occur on CREATE too. FILE_SUPERSEDE, FILE_OVERWRITE &
FILE_OVERWRITE_IF cause file truncation to zero length if successful.

SetFilePointer does not extend the file. Only Write & SetEOF extend.

Notepad memory maps the file, be sure you are catching SetEndOfFile with
PAGING_IO set. When the file closes, the correct EOF will be set (truncation
may occur).

/ted

-----Original Message-----
From: Rodrigo Strauss [mailto:xxxxx@scua.com.br]
Sent: Tuesday, November 25, 2003 11:21 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Safe way to detect file truncation or extension

Hi!

Is there any safe way to detect when an app is truncating a file or
extending it without writing (using SetFilePointer + SetEndOfFile)?

Debugging with WinDbg, I’ve noted that while creating a file with
few
bytes using notepad, the pEndOfFileInfo->EndOfFile in
IRP_MJ_SET_INFORMATION is 0x1000 (4k). I didn’t know that the memory
page size would affect the file size… And the IRP_NO_CACHE flag is
never on while setting the end of file.

Thanks,

Strauss

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@livevault.com To unsubscribe
send a blank email to xxxxx@lists.osr.com

3

> SetFilePointer does not extend the file. Only Write & SetEOF extend.

To extend the file size without write, you do SetFilePointer([more than
file size]), and SetEndOfFile(hFile). I need to detect when the file is
extended this way, without writing in the file.

/ted

-----Original Message-----
From: Rodrigo Strauss [mailto:xxxxx@scua.com.br]
Sent: Tuesday, November 25, 2003 11:21 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Safe way to detect file truncation or extension

Hi!

Is there any safe way to detect when an app is truncating a file or
extending it without writing (using SetFilePointer + SetEndOfFile)?

Debugging with WinDbg, I’ve noted that while creating a file with
few
bytes using notepad, the pEndOfFileInfo->EndOfFile in
IRP_MJ_SET_INFORMATION is 0x1000 (4k). I didn’t know that the memory
page size would affect the file size… And the IRP_NO_CACHE flag is
never on while setting the end of file.

Thanks,

Strauss

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@livevault.com To unsubscribe
send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@scua.com.br
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

My comments (still correct) were about IRPs and not Win32 API.

/ted

-----Original Message-----
From: Rodrigo Strauss [mailto:xxxxx@scua.com.br]
Sent: Tuesday, November 25, 2003 1:25 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] RE: Safe way to detect file truncation or extension

SetFilePointer does not extend the file. Only Write & SetEOF extend.

To extend the file size without write, you do SetFilePointer([more
than
file size]), and SetEndOfFile(hFile). I need to detect when the file is
extended this way, without writing in the file.

/ted

-----Original Message-----
From: Rodrigo Strauss [mailto:xxxxx@scua.com.br]
Sent: Tuesday, November 25, 2003 11:21 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Safe way to detect file truncation or extension

Hi!

Is there any safe way to detect when an app is truncating a file or
extending it without writing (using SetFilePointer + SetEndOfFile)?

Debugging with WinDbg, I’ve noted that while creating a file with
few
bytes using notepad, the pEndOfFileInfo->EndOfFile in
IRP_MJ_SET_INFORMATION is 0x1000 (4k). I didn’t know that the memory
page size would affect the file size… And the IRP_NO_CACHE flag is
never on while setting the end of file.

Thanks,

Strauss

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@livevault.com To
unsubscribe
send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@scua.com.br
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@livevault.com
To unsubscribe send a blank email to xxxxx@lists.osr.com