1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

MFT DataSize, AllocatedSize and LastWriteTime

Discussion in 'Windows XP' started by Matt, May 12, 2010.

  1. Matt

    Matt Flightless Bird


    I'm writing some code that reads the FileName attribute file records from
    the MFT by using the FSCTL_GET_NTFS_FILE_RECORD api call.

    I've noticed that, for most records, the DataSize, AllocatedSize and
    LastWriteTime are accurate when compared to the values in the win explorer
    file properties dialog.However, for some more recent files/records the size
    values are always 0 and the timestamp is incorrect.

    Has anyone experienced this issue? I'm hoping to gain an understanding
    of how/when NFTS updates the record with the correct values.


Share This Page