Two conceptual questions concerning alternate data streams (ADS)

NTFSD
1

Hi,

when working with ADS, I got two questions that I couldn’t answer from documentation nor web search (perhaps the wrong search terms?).

  1. what is the maximum length of an ADS name. NTFS has a maximum file name length of 255 characters for each “path segment”. Does this limit apply to stream names as well? If so, is it cumulative, i.e.
    a.) [namelen]+[streamnamelen] <= 2*255
    … or rather this one:
    b.) [namelen]+[streamnamelen] <= 255
  2. Is it possible to rename an ADS apart from actually copying it and deleting the “old” one? Something like moving it, for example.

Thanks in advance,

Oliver

DDKWizard and DDKBUILD: http:

Trunk (potentially unstable) version: http:</http:></http:>

2
  1. Hmmm … dunno … good question :slight_smile:
  2. Yes. It’s described in the WDK under FILE_RENAME_INFORMATION.

“Oliver Schneider” wrote in message
news:xxxxx@ntfsd…
> Hi,
>
> when working with ADS, I got two questions that I couldn’t answer from
> documentation nor web search (perhaps the wrong search terms?).
>
> 1. what is the maximum length of an ADS name. NTFS has a maximum file name
> length of 255 characters for each “path segment”. Does this limit apply to
> stream names as well? If so, is it cumulative, i.e.
> a.) [namelen]+[streamnamelen] <= 2*255
> … or rather this one:
> b.) [namelen]+[streamnamelen] <= 255

> 2. Is it possible to rename an ADS apart from actually copying it and
> deleting the “old” one? Something like moving it, for example.
>
> Thanks in advance,
>
> Oliver
> –
> ---------------------------------------------------
> DDKWizard and DDKBUILD: http:
>
> Trunk (potentially unstable) version:
> http:
>
></http:></http:>

3

Lyndon,

  1. Hmmm … dunno … good question :slight_smile:
    Yeah, I know :slight_smile:
  1. Yes. It’s described in the WDK under FILE_RENAME_INFORMATION.
    Thanks for the info. I suppose in this case I need to do some debugging, because actually MoveFileEx is only a wrapper around NtSetInformationFile with this information class, so I hope it can be done with the Win32 API (the project is not KM code). So far I was unsuccessful.

// Oliver

DDKWizard and DDKBUILD: http:

Trunk (potentially unstable) version: http:</http:></http:>

4

Oliver
It can be done with nt native api [Zw|Nt]SetInformationFile
FileRenameInformation :slight_smile:
Cheers, Lyndon

“Oliver Schneider” wrote in message
news:xxxxx@ntfsd…
> Lyndon,
>
>> 1. Hmmm … dunno … good question :slight_smile:
> Yeah, I know :slight_smile:
>
>> 2. Yes. It’s described in the WDK under FILE_RENAME_INFORMATION.
> Thanks for the info. I suppose in this case I need to do some debugging,
> because actually MoveFileEx is only a wrapper around NtSetInformationFile
> with this information class, so I hope it can be done with the Win32 API
> (the project is not KM code). So far I was unsuccessful.
>
> // Oliver
> –
> ---------------------------------------------------
> DDKWizard and DDKBUILD: http:
>
> Trunk (potentially unstable) version:
> http:
>
></http:></http:>

5

Oliver Schneider wrote:

Hi,

when working with ADS, I got two questions that I couldn’t answer from documentation nor web search (perhaps the wrong search terms?).

  1. what is the maximum length of an ADS name. NTFS has a maximum file name length of 255 characters for each “path segment”. Does this limit apply to stream names as well? If so, is it cumulative, i.e.
    a.) [namelen]+[streamnamelen] <= 2*255
    … or rather this one:
    b.) [namelen]+[streamnamelen] <= 255
  2. Is it possible to rename an ADS apart from actually copying it and deleting the “old” one? Something like moving it, for example.

Thanks in advance,

Oliver

  1. The maximum length of a named stream is 255 WCHARs. The limit is
    imposed as a seperate component, ie [namelen] <= 255 && [streamnamelen]
    <= 255.

  2. Yes. From an API perspective, this is just a normal rename
    operation. In kernel mode, you would see a rename with the
    TargetFileObject set to NULL (since it must be a rename to the same
    directory), and a rename buffer starting with a colon and describing the
    new stream name. The FileObject opened originally will be for the
    source stream. Note that NTFS imposes some additional (needless)
    restrictions: a) a default data stream must exist on each file, so
    renaming the default stream to a named stream implicitly creates a new
    default stream; b) superseding an existing stream only works if the file
    size of the target stream is currently zero, although it will tolerate a
    nonzero allocation size.

Also, bear in mind that the above is specific to NTFS in its current
incarnation. A filter should not, as far as possible, rely on the above
limitations. It would be perfectly legal, perhaps desirable, to
implement an underlying filesystem with file/stream names longer than
255 chars, or to remove restrictions on stream renames such that real
supersedes work. Ideally, all code should assume that the maximum
length of a filename is the size of a UNICODE_STRING, and no component
limits exist. Where it is impossible/impractical to do so, bear in mind
that over time the code may need to adjust for different limits on
different versions of Windows.

  • M