using FSRTL_COMMON_FCB_HEADER.FileSize

NTFSD
1

Hello,
In a file system filter, is it safe and accurate to get an open
file’s logical size (the size the user sees) from
FSRTL_COMMON_FCB_HEADER.FileSize instead of querying for
FILE_STANDARD_INFORMATION and using FILE_STANDARD_INFORMATION.EndOfFile?
Will the value be the same in every case and can I always depend on the
common FCB header being present for an open file?

Thanks,
Joel

2

using FSRTL_COMMON_FCB_HEADER.FileSize>Hello,

In a file system filter, is it safe and accurate to get an open
file’s logical
size (the size the user sees) from
FSRTL_COMMON_FCB_HEADER.FileSize instead of querying for

IMHO yes - provided you have acquired MainResource shared (enough to
suspend all size-changing operations).

Max