The example in this topic demonstrates how to use basic NTFS file system streams.

This example creates a file, called "TestFile," with a size of 16 bytes. However, the file also has an additional ::$DATA stream type, named "Stream" which adds an additional 23 bytes that is not reported by the operating system. Therefore, when you view the file size property for the file, you see only the size of default ::$DATA stream for the file.

#include <windows.h>#include <stdio.h>void main( ) {  HANDLE hFile, hStream;  DWORD dwRet;  hFile = CreateFile( TEXT("TestFile"), // Filename                      GENERIC_WRITE,    // Desired access                      FILE_SHARE_WRITE, // Share flags                      NULL,             // Security Attributes                      OPEN_ALWAYS,      // Creation Disposition                      0,                // Flags and Attributes                      NULL );           // OVERLAPPED pointer  if( hFile == INVALID_HANDLE_VALUE )   {    printf( "Cannot open TestFile\n" );    return;   }  else   {    WriteFile( hFile,              // Handle               "This is TestFile", // Data to be written               16,                 // Size of data, in bytes               &dwRet,             // Number of bytes written               NULL );             // OVERLAPPED pointer    CloseHandle( hFile );    hFile = INVALID_HANDLE_VALUE;   }  hStream = CreateFile( TEXT("TestFile:Stream"), // Filename                        GENERIC_WRITE,           // Desired access                        FILE_SHARE_WRITE,        // Share flags                        NULL,                    // Security Attributes                        OPEN_ALWAYS,             // Creation Disposition                        0,                       // Flags and Attributes                        NULL );                  // OVERLAPPED pointer  if( hStream == INVALID_HANDLE_VALUE )    printf( "Cannot open TestFile:Stream\n" );  else   {    WriteFile( hStream,                   // Handle               "This is TestFile:Stream", // Data to be written               23,                        // Size of data               &dwRet,                    // Number of bytes written               NULL);                     // OVERLAPPED pointer    CloseHandle( hStream );    hStream = INVALID_HANDLE_VALUE;   }}

If you typeType TestFile at a command prompt, it displays the following output:

This is TestFile

However, if you type the wordsType TestFile:Stream, it generates the following error:

"The filename, directory name, or volume label syntax is incorrect."

To view what is in TestFile:stream, use one of the following commands:

More < TestFile:Stream

More < TestFile:Stream:$DATA

The text displayed is as follows:

This is TestFile:Stream

Related topics

File Streams