urgh 8.3 file names

NTFSD
1

I was wondering if anyone could point me in the right direction here. I’ve
got an arbitrary file name in irp_mj_create, and it can be a regular file
name, or an 8.3 file name (system generated). I need to know which it is,
and if its the 8.3 file name, I need to find the regular file name.

So, does anyone know, is there a quick and easy way in a filter driver to
ascertain whether the name is or is not an 8.3 name, and when it is an 8.3
name, to then get the regular file name?

Any pointers would sure be appreciated. So far, all I’ve got to chew on,
is using FileBothDirectoryInformation on the parent directory (well,
recursively on the ancestor directories, in case one of them is an 8.3
hrmm name also). This seems to be a lot^H^H^H bit inefficient.

Thanks in advance
Lyndon

2

Yep, it’s bad.

You have to query for each component of the path.

You can’t just look for tildes because short names
don’t have to have them. Some new api was introduced
recently that allows you to change the short name to
whatever you want (backup/restore purposes).

This according to Neal C. here on the list.

When querying, put in the name you have. That way you
will only get one result back.

Randy

— “Lyndon J. Clarke”
wrote:
> I was wondering if anyone could point me in the
> right direction here. I’ve
> got an arbitrary file name in irp_mj_create, and it
> can be a regular file
> name, or an 8.3 file name (system generated). I need
> to know which it is,
> and if its the 8.3 file name, I need to find the
> regular file name.
>
> So, does anyone know, is there a quick and easy way
> in a filter driver to
> ascertain whether the name is or is not an 8.3 name,
> and when it is an 8.3
> name, to then get the regular file name?
>
> Any pointers would sure be appreciated. So far, all
> I’ve got to chew on,
> is using FileBothDirectoryInformation on the parent
> directory (well,
> recursively on the ancestor directories, in case one
> of them is an 8.3
> hrmm name also). This seems to be a lot^H^H^H bit
> inefficient.
>
> Thanks in advance
> Lyndon
>
> —
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
xxxxx@lists.osr.com

__________________________________
Do you Yahoo!?
SBC Yahoo! DSL - Now only $29.95 per month!
http://sbc.yahoo.com

3

From what I know, the only way is to send queries via
IRP_MJ_DIRECTORY_CONTROL. Note also that in ntifs.h the
IrpSp->Parameters.QueryDirectory.FileName is declared as PSTRING but it is
not, its PUNICODE_STRING.
Wbr Primoz

-----Original Message-----
From: Lyndon J. Clarke [mailto:xxxxx@neverfailgroup.com]
Sent: Monday, June 30, 2003 4:44 PM
To: File Systems Developers
Subject: [ntfsd] urgh 8.3 file names

I was wondering if anyone could point me in the right
direction here. I’ve got an arbitrary file name in
irp_mj_create, and it can be a regular file name, or an 8.3
file name (system generated). I need to know which it is, and
if its the 8.3 file name, I need to find the regular file name.

So, does anyone know, is there a quick and easy way in a
filter driver to ascertain whether the name is or is not an
8.3 name, and when it is an 8.3 name, to then get the regular
file name?

Any pointers would sure be appreciated. So far, all I’ve got
to chew on, is using FileBothDirectoryInformation on the
parent directory (well, recursively on the ancestor
directories, in case one of them is an 8.3 hrmm name also).
This seems to be a lot^H^H^H bit inefficient.

Thanks in advance
Lyndon

You are currently subscribed to ntfsd as:
xxxxx@hermes.si To unsubscribe send a blank email to
xxxxx@lists.osr.com

4

And, just as a warning. There are conditions that can prevent you from
querying the parent directory for the actual leaf name of the child.
The condition I know of is a security consideration where the parent
directory does not allow traverse access to the thread that is opening
the file, but does allow that thread to open the file itself. This can
be solved by deferring the filename lookup to a system work thread - but
it complicates matters a bit. Looking up every element of the path can
be a pretty painful exercise - luckily I use the parent $MFT ID to
identify the directory without having to resolve its entire full
pathname, which can be pretty expensive.

-----Original Message-----
From: Primoz Beltram [mailto:xxxxx@hermes.si]
Sent: Monday, June 30, 2003 12:15 PM
To: File Systems Developers
Subject: [ntfsd] RE: urgh 8.3 file names

From what I know, the only way is to send queries via
IRP_MJ_DIRECTORY_CONTROL. Note also that in ntifs.h the
IrpSp->Parameters.QueryDirectory.FileName is declared as PSTRING but it
is
not, its PUNICODE_STRING.
Wbr Primoz

-----Original Message-----
From: Lyndon J. Clarke [mailto:xxxxx@neverfailgroup.com]
Sent: Monday, June 30, 2003 4:44 PM
To: File Systems Developers
Subject: [ntfsd] urgh 8.3 file names

I was wondering if anyone could point me in the right
direction here. I’ve got an arbitrary file name in
irp_mj_create, and it can be a regular file name, or an 8.3
file name (system generated). I need to know which it is, and
if its the 8.3 file name, I need to find the regular file name.

So, does anyone know, is there a quick and easy way in a
filter driver to ascertain whether the name is or is not an
8.3 name, and when it is an 8.3 name, to then get the regular
file name?

Any pointers would sure be appreciated. So far, all I’ve got
to chew on, is using FileBothDirectoryInformation on the
parent directory (well, recursively on the ancestor
directories, in case one of them is an 8.3 hrmm name also).
This seems to be a lot^H^H^H bit inefficient.

Thanks in advance
Lyndon

You are currently subscribed to ntfsd as:
xxxxx@hermes.si To unsubscribe send a blank email to
xxxxx@lists.osr.com

You are currently subscribed to ntfsd as: xxxxx@exagrid.com
To unsubscribe send a blank email to xxxxx@lists.osr.com