NTFS Alternate Data Streams

← →
A.M.D.F. (2003-10-26 21:36) [0]

Пишу прогу, использующую файловые потоки NTFS (MS Knowledge base Q105763) и хотел бы узнать, а нет ли какой WinAPI функции, которая бы возвращала бы все прикрепленные к файлу потоки по его пути? Ведь узнает же както система о них, если скопировать файл с потоками на FAT32 раздел?

← →
Игорь Шевченко (2003-10-26 21:52) [1]

Streams Backup and Enumeration
Is there a way—an API function or two—to enumerate all the streams a certain file has? Yes, there is, but it"s not as easy and intuitive as it should be. The Win32 backup API functions (BackupRead, BackupWrite, and so forth) could be used to enumerate the streams within a file. However, they are a bit quirky to use and look more like a workaround than an effective and definitive solution.

The idea is that when you want to back up a file or an entire folder, you need to package and store all possible information. For this reason, BackupRead() is your best friend when it comes to trying to enumerate the streams of a file. Let"s focus on the function"s prototype:

BOOL BackupRead(
HANDLE hFile,
LPBYTE lpBuffer,
DWORD nNumberOfBytesToRead,
LPDWORD lpNumberOfBytesRead,
BOOL bAbort,
BOOL bProcessSecurity,
LPVOID *lpContext
);

For our purposes, you can ignore here aspects like context and security. The hFile argument must be obtained through a call to CreateFile(), while lpBuffer should point to a WIN32_STREAM_ID data structure:

typedef struct _WIN32_STREAM_ID {
DWORD dwStreamId;
DWORD dwStreamAttributes;
LARGE_INTEGER Size;
DWORD dwStreamNameSize;
WCHAR cStreamName[ANYSIZE_ARRAY];
} WIN32_STREAM_ID, *LPWIN32_STREAM_ID;

The first 20 bytes of such a structure represent the header of each stream. The name of the stream begins immediately after the dwStreamNameSize field and the content of the stream follows the name. Because the traditional content of the file can be seen as a stream, although an unnamed stream, to enumerate all the streams, you just need to loop until BackupRead returns False. BackupRead, in fact, is supposed to read all the information associated with a given file or folder:

WIN32_STREAM_ID sid;
ZeroMemory(&sid, sizeof(WIN32_STREAM_ID));
DWORD dwStreamHeaderSize = (LPBYTE)&sid.cStreamName -
(LPBYTE)&sid+ sid.dwStreamNameSize;
bContinue = BackupRead(hfile, (LPBYTE) &sid,
dwStreamHeaderSize, &dwRead, FALSE, FALSE,
&lpContext);

The preceding snippet is the crucial code that reads in the header of the stream. If the operation is successful, you can attempt to read the actual name of the stream:

WCHAR wszStreamName[MAX_PATH];
BackupRead(hfile, (LPBYTE) wszStreamName, sid.dwStreamNameSize,
&dwRead, FALSE, FALSE, &lpContext);

Before attacking with the next stream, first move forward the backup pointer by calling BackupSeek():

BackupSeek(hfile, sid.Size.LowPart, sid.Size.HighPart,
&dw1, &dw2, &lpContext);

In most cases, you can treat streams as if they were regular files—for example, to delete a stream resort to DeleteFile(). If you want to refresh their content, just use ReadFile() and WriteFile(). There"s no official and supported way to move or rename streams. In the final part of the article, I"ll utilize this code to build an NTFS 2000-specific Windows shell extension that adds a new property page to all files with stream information. In the meantime, let"s take a whirlwind tour of another NTFS feature.

← →
Alex Konshin (2003-10-26 22:24) [2]

http://www.sysinternals.com/ntw2k/source/misc.shtml#Streams

NTFS Alternate Data Streams Найти похожие ветки