• Welcome to Tux Reports: Where Penguins Fly. We hope you find the topics varied, interesting, and worthy of your time. Please become a member and join in the discussions.

MFT DataSize, AllocatedSize and LastWriteTime



Flightless Bird

I'm writing some code that reads the FileName attribute file records from
the MFT by using the FSCTL_GET_NTFS_FILE_RECORD api call.

I've noticed that, for most records, the DataSize, AllocatedSize and
LastWriteTime are accurate when compared to the values in the win explorer
file properties dialog.However, for some more recent files/records the size
values are always 0 and the timestamp is incorrect.

Has anyone experienced this issue? I'm hoping to gain an understanding
of how/when NFTS updates the record with the correct values.