File System Behavior Overview
Page 1 of 59
File System Behavior in the Microsoft
Windows Environment
This document contains a compilation of file system specific topics. The audience for these topics is
developers interested in creating file systems that are functionally compatible with existing Windows file
systems.
This document covers the native windows files systems:
NTFS
FAT
EXFAT
CDFS
UDF
Differences in functionality between the above file systems will be explicitly noted. The term ‘file
system’ will be used to refer to all the file systems for functionality that does not differ between them.
File System Behavior Overview
Page 2 of 59
Revision History
Date
Changes
June 2008
Initial Revision
April 2009
Differences between various windows file systems
Windows 7 Oplock changes
File Stream naming conventions
May 2009
IRP return codes
Timestamps
Wildcards
Corrections to stream naming information
File System Behavior Overview
Page 3 of 59
Table of Contents
1 File Streams ----------------------------------------------------------------------------------------------------------------- 5
2 Oplock Semantics ---------------------------------------------------------------------------------------------------------- 6
2.1 Overview -------------------------------------------------------------------------------------------------------------- 6
2.2 Granting Oplocks ---------------------------------------------------------------------------------------------------- 7
2.3 Breaking Oplocks --------------------------------------------------------------------------------------------------- 12
2.4 Acknowledging Oplock Breaks ---------------------------------------------------------------------------------- 24
2.5 Differences between the various file systems in Windows: --------------------------------------------- 25
3 Byte Range Lock Semantics --------------------------------------------------------------------------------------------- 26
3.1 Overview ------------------------------------------------------------------------------------------------------------- 26
3.2 Functional Description -------------------------------------------------------------------------------------------- 26
3.3 Processing Details -------------------------------------------------------------------------------------------------- 28
3.4 Side Effects of Byte Range Locks ------------------------------------------------------------------------------- 29
4 File Deletion Semantics -------------------------------------------------------------------------------------------------- 32
4.1 Overview: ------------------------------------------------------------------------------------------------------------ 32
4.2 Summary ------------------------------------------------------------------------------------------------------------- 32
4.3 Detailed Description ----------------------------------------------------------------------------------------------- 33
5 IRP Return Codes ---------------------------------------------------------------------------------------------------------- 36
5.1 IRP_MJ_CREATE ---------------------------------------------------------------------------------------------------- 36
5.2 IRP_MJ_CLOSE ------------------------------------------------------------------------------------------------------ 37
5.3 IRP_MJ_READ ------------------------------------------------------------------------------------------------------- 37
5.4 IRP_MJ_WRITE ------------------------------------------------------------------------------------------------------ 37
5.5 IRP_MJ_QUERY_INFORMATION -------------------------------------------------------------------------------- 38
5.6 IRP_MJ_QUERY_VOLUME_INFORMATION ------------------------------------------------------------------ 40
5.7 IRP_MJ_SET_INFORMATION ------------------------------------------------------------------------------------ 41
5.8 IRP_MJ_SET_VOLUME_INFORMATION ----------------------------------------------------------------------- 42
5.9 IRP_MJ_QUERY_EA ------------------------------------------------------------------------------------------------ 43
5.10 IRP_MJ_SET_EA ----------------------------------------------------------------------------------------------------- 43
5.11 IRP_MJ_FLUSH_BUFFERS ----------------------------------------------------------------------------------------- 43
5.12 IRP_MJ_DIRECTORY_CONTROL --------------------------------------------------------------------------------- 44
5.13 IRP_MJ_FILE_SYSTEM_CONTROL ------------------------------------------------------------------------------ 45
File System Behavior Overview
Page 4 of 59
5.14 IRP_MJ_LOCK_CONTROL ----------------------------------------------------------------------------------------- 50
5.15 IRP_MJ_CLEANUP -------------------------------------------------------------------------------------------------- 50
5.16 IRP_MJ_QUERY_SECURITY --------------------------------------------------------------------------------------- 50
5.17 IRP_MJ_SET_SECURITY-------------------------------------------------------------------------------------------- 50
5.18 IRP_MJ_QUERY_QUOTA ------------------------------------------------------------------------------------------ 51
5.19 IRP_MJ_SET_QUOTA ---------------------------------------------------------------------------------------------- 51
6 Time stamps ---------------------------------------------------------------------------------------------------------------- 52
6.1 NTFS ------------------------------------------------------------------------------------------------------------------- 52
6.2 UDF -------------------------------------------------------------------------------------------------------------------- 53
6.3 FAT --------------------------------------------------------------------------------------------------------------------- 54
6.4 exFAT ------------------------------------------------------------------------------------------------------------------ 55
7 Wild Cards ------------------------------------------------------------------------------------------------------------------ 57
7.1 Wild Card Characters ---------------------------------------------------------------------------------------------- 57
7.2 Wild Card Matching ------------------------------------------------------------------------------------------------ 57
File System Behavior Overview
Page 5 of 59
1 File Streams
A file stream is a sequence of bytes. File operations such as read and write operate on streams.
Historically file systems have typically had only one stream per file that holds the files data and thus had
no need to distinguish between the concept of a file and a stream. However some modern file systems
like NTFS allow multiple data streams per file so in Windows it’s necessary to distinguish between a file
and a stream.
In windows all files systems have one default data stream. The default data stream is associated with a
file handle when opening a file without specifying a stream name: (e.g. CreateFile(“SomeFile”,…)) This
is the only method supported for the FAT, CDFS, and EXFAT file systems.
The NTFS and UDFS file systems can have alternate named data streams. To open a named data stream
use the name syntax filename:stream_name. For example to open a stream named ‘streamX’ on file
‘SomeFile’ : CreateFile(“SomeFile:streamX”, …).
