why NTFS reports incorrect file sizes

D. Hugh Redelmeier hugh-pmF8o41NoarQT0dZR+AlfA at public.gmane.org
Thu Jan 19 05:05:03 UTC 2012


This is a blog entry from Raymond Chen, a really interesting Microsoft 
worker:
  <http://blogs.msdn.com/b/oldnewthing/archive/2011/12/26/10251026.aspx>

Basically, he justifies NTFS reporting incorrect sizes by saying "it's a 
lot cheaper than not lying".

Apparently NTFS supports hard links.  Each link has its own copy of SOME 
metadata (most usefully file size).  The metadata in a directory entry 
gets updated when the file handle created from that directory entry is 
closed (and perhaps when it is opened).  So if hard links were ever used 
seriously in NTFS, there would be a lot of lying.

If the file has been appended to since the last open or close of that
directory entry, then it will be wrong too.  So the lying isn't just
to do with hard links.

Since directory traversal in FAT gave you this metadata, they felt they 
had to give it to you in NTFS.  Rather than get it right (possibly slow), 
they decided that it would be better to be fast and wrong.  Yuck.

The FindFirstFile manual seems to admit to this lying, but in a minimizing 
way.

<http://msdn.microsoft.com/en-us/library/windows/desktop/aa364418%28v=vs.85%29.aspx>

    Note In rare cases, file information on NTFS file systems may not
    be current at the time you call this function. To be assured of
    getting the current file information, call the
    GetFileInformationByHandle function.

That description does not make the problem clear to me as a
programmer.  "Rare" isn't really a useful characterization.

Actually, there seems to be more questionable metadata.  See 
<http://msdn.microsoft.com/en-us/library/windows/desktop/aa365740%28v=vs.85%29.aspx>
I bet that only the last two field of the datastructure are reliable: 
cFileName and cAlternateFilename (the 8.3 filename).


In that FindFirstFile manual, I found the following rather odd directive:

    If you are writing a 32-bit application to list all the files in a
    directory and the application may be run on a 64-bit computer, you
    should call the Wow64DisableWow64FsRedirectionfunction before
    calling FindFirstFile and call Wow64RevertWow64FsRedirection after
    the last call to FindNextFile. For more information, see File
    System Redirector.

So 32-bit applications have to be 64-bit aware?  Wow indeed.
--
The Toronto Linux Users Group.      Meetings: http://gtalug.org/
TLUG requests: Linux topics, No HTML, wrap text below 80 columns
How to UNSUBSCRIBE: http://gtalug.org/wiki/Mailing_lists





More information about the Legacy mailing list