Search code examples
driverwindows-kernel

NtQueryInformationFile(FileStreamInformation) fails with STATUS_END_OF_FILE


I deal with application that scans files at a location (identified by UNC path) and gathers various bits of information about them. One of such bits is a list of alternate files streams -- which gets retrieved via NtQueryInformationFile(..., FileStreamInformation) call.

This works for untold number of files with exception of very few -- for those few (mostly jpg originated from some camera, but also docx and zip) that function call fails with STATUS_END_OF_FILE. I can't find any explanation of why. There are other files in same directory(ies) that have no such problem, dir /r shows no alternate streams, copy works fine. Data corruption is very unlikely.

I would appreciate any ideas that may explain this. Thank you.

More info:

  • target is located on VNX 7500 (maybe a bug in their SMB server implementation?)

  • NTFS


Solution

  • Something went wrong with alternate streams. Listing them fails, but if you copy file -- it arrives to destination without any alternate streams (and application works with copied file without problems). I suspect OS copy operation silently ignores alt stream-related failures and (if they happen) doesn't copy them.

    So, basically, copying files elsewhere and copying them back (overwriting originals) fixes the problem.