Using Streams

The example in this topic demonstrates how to use basic NTFS file system streams.

This example creates a file, called "TestFile," with a size of 16 bytes. However, the file also has an additional ::$DATA stream type, named "Stream" which adds an additional 23 bytes that is not reported by the operating system. Therefore, when you view the file size property for the file, you see only the size of default ::$DATA stream for the file.

#include <windows.h>
#include <stdio.h>

void main( )
 {
 HANDLE hFile, hStream;
 DWORD dwRet;

 hFile = CreateFile( TEXT("TestFile"), // Filename
 GENERIC_WRITE, // Desired access
 FILE_SHARE_WRITE, // Share flags
 NULL, // Security Attributes
 OPEN_ALWAYS, // Creation Disposition
 0, // Flags and Attributes
 NULL ); // OVERLAPPED pointer
 if( hFile == INVALID_HANDLE_VALUE )
 {
 printf( "Cannot open TestFile\n" );
 return;
 }
 else
 {
 WriteFile( hFile, // Handle
 "This is TestFile", // Data to be written
 16, // Size of data, in bytes
 &dwRet, // Number of bytes written
 NULL ); // OVERLAPPED pointer
 CloseHandle( hFile );
 hFile = INVALID_HANDLE_VALUE;
 }

 hStream = CreateFile( TEXT("TestFile:Stream"), // Filename
 GENERIC_WRITE, // Desired access
 FILE_SHARE_WRITE, // Share flags
 NULL, // Security Attributes
 OPEN_ALWAYS, // Creation Disposition
 0, // Flags and Attributes
 NULL ); // OVERLAPPED pointer
 if( hStream == INVALID_HANDLE_VALUE )
 printf( "Cannot open TestFile:Stream\n" );
 else
 {
 WriteFile( hStream, // Handle
 "This is TestFile:Stream", // Data to be written
 23, // Size of data
 &dwRet, // Number of bytes written
 NULL); // OVERLAPPED pointer
 CloseHandle( hStream );
 hStream = INVALID_HANDLE_VALUE;
 }
}

If you type Type TestFile at a command prompt, it displays the following output:

This is TestFile

However, if you type the words Type TestFile:Stream, it generates the following error:

"The filename, directory name, or volume label syntax is incorrect."

To view what is in TestFile:stream, use one of the following commands:

More < TestFile:Stream

More < TestFile:Stream:$DATA

The text displayed is as follows:

This is TestFile:Stream

Related topics

File Streams