NTFS: minor flaws in handling of streams and tunneling
- From: "Atlan" <atlan@xxxxxxxxxxxx>
- Date: 22 Sep 2006 01:42:11 -0700
I have discovered two minor flaws in NTFS that I would like to discuss:
Flaw 1:
-------------
In NTFS every file can have streams. Lets take the stream
"\005SummaryInformation" which is used to save the Summary Information
visible in the properties of a file.
If you add this stream by entering a comment in the properties of the
file the modification date of the file changes. Every further
modification to the summary stream will change the modification date
too.
But if you simply delete the associated stream with DeleteFile the
modification date is not changed to reflect this operation:
DeleteFileW(L"c:\\file.txt:\005SummaryInformation");
I have expected that the modification date of a file changes when you
delete a stream.
Flaw 2:
-------------
NTFS Tunneling preserves the date values of files when you replace
older files with new files. This behaviour is necessary for backward
compatibility and for certain file handling procedures. You can control
how long the date values will be preserved by manipulating the registry
value "MaximumTunnelEntryAgeInSeconds".
In addition you can disable Tunneling by setting
"MaximumTunnelEntries=0". But it is not disabled in a way that I have
expected. Here are two scenarios I tried out after disabling Tunneling
(Computer was restarted):
Scenario I:
a) file Z exists in folder F
b) delete file Z from folder F
c) copy file named Z to Folder F
=> date values are not preserved, behaves as expected
Scenario II:
a) file Z exists in folder F
b) replace file Z in folder F with newer file named Z
=> date values of older file are preserved, Tunneling still active,
unexpected behaviour
Best regards,
Holger
.
- Follow-Ups:
- Re: minor flaws in handling of streams and tunneling
- From: Alexander Grigoriev
- Re: minor flaws in handling of streams and tunneling
- Prev by Date: Re: Keyboard keycodes.
- Next by Date: Re: Mapping memory of another process
- Previous by thread: RtlAllocateHeap hooking?
- Next by thread: Re: minor flaws in handling of streams and tunneling
- Index(es):
Relevant Pages
|