Free Web Hosting | free host | Free Web Space | BlueHost Review

WST 17 - NTFS Streams
Home Up Interests Downloads (New) My Resume Links Feedback

 

Interests
Downloads (New)
My Resume
Links
WST
Feedback

Hi all,

Continuing with our topics, we will look at a new feature provided in the NTFS file system this week. This feature is called Streams, or NTFS streams (well streams are there on non NTFS systems also, but multiple data streams is supported only on NTFS). The NTFS stream provides a way to store multiple types of data into same file without one type of data getting mangled with the other. The streams for a file are specified by their names. The proper name of an stream is filename:streamname.

As I said, streams are available since Win 3.1 days, but multiple data streams in a single file is only supported on NTFS volumes. So let's say you have a file named foo.txt. Now to open this file you will do something like this:

HANLDE hFile = CreateFile("foot.txt", GENERIC_READ|GENERIC_WRITE, 0, NULL, OPNE_EXISTING, 0, 0);

What this will do is, it will open the main (default) stream of the file for read purposes.

Now to open a stream say MyStream for the same file you will call this API something like this:

HANLDE hFile = CreateFile("foot.txt:MyStream", GENERIC_READ|GENERIC_WRITE, 0, NULL, OPNE_EXISTING, 0, 0);

so instead of opening the default stream, this will open (or create a new one) MyStream for given file.

Now you can read/write anything to this stream WITHOUT affecting the main stream contents of the file.

Note, that the size of the file in the explorer will not show any effect due to writing of this stream (that's why you can also use streams to hide data into files ! ).

Streams are the way Word and other applications use to store the extra info about document contents in the given file. Note that since streams are only supported on NTFS volume, if you try to copy a file containing streams from NTFS to non-NTFS volume, you will be given a warning about loosing a stream(s). If you copy it anyway, you will end up loosing all the streams and the data in those streams for that file.

Experiment with the streams, and read about them to know how/where they are used most. You can use BackupRead() and BackupWrite() API's to enumerate the streams in a given file. Read about these functions.

Exercises:

1. Write an application which can read the custom property page info (right click a word file on an NTFS volume and select custom in the property page), of a word document file. Find out what stream Word uses to write this info.

2. Develop your own application which can write such info for text files. Note that the custom property pages appears, NOT because of streams, but these are implemented by Shell Extensions (we might cover them some time in our future topic). So if you want to develop a similar shell extension for text files, you know how to do it now.

3. Write an application which can enumerate all the streams in a given file (See BackupRead() and other functions).

4. Write an application which can hide/show contents of a file by writing the file data to a stream in that file. Of course this application will only work on an NTFS system, but it's a neat utility to have.

So that was all that I know about NTFS streams, experiment on your own, and share with all if you find something interesting.

We will try to cover some other important topic next week.

Thanks for your time !

-Farooque

 

 

HyperCounter
Bpath Counter