File Streams (Windows)

File Streams

A stream is a sequence of bytes. In the NTFS file system, streams contain the data that is written to a file, and that gives more information about a file than attributes and properties. For example, you can create a stream that contains search keywords, or the identity of the user account that creates a file.

Each stream that is associated with a file has its own allocation size, actual size, and valid data length:

The allocation size is the amount of disk space that is reserved for a stream.
The actual size is the number of bytes that are being used by a caller.
The valid data length (VDL) is the number of bytes that are initialized from the allocation size for the stream.

Each stream also maintains its own state for compression, encryption, and sparseness. The sparse attribute on the file is set if any of the streams have ever been sparse.

There are no file times associated with a stream. The file times for a file are updated when any stream in a file is updated.

Opportunistic locks are maintained per stream. Sharing modes are also maintained per stream. When delete access is requested on a file, the operating system checks for delete access on all open streams in a file. If another process has opened a stream without the FILE_SHARE_DELETE permission, you cannot open the file for delete access.

If a file being copied has a data stream and the network redirector is used, the file can only be copied if the client has both the read permission and the read attributes permission.

Naming Conventions for Streams

When specified from the Windows shell command line, the full name of a stream is filename:stream name:stream type, as in the following example: myfile.dat:stream1:$DATA

Any characters that are legal for a file name are also legal for the stream name, including spaces. For more information, see Naming a File. The stream type specifier is internal to the NTFS file system. Users therefore can't create new types, but they can open existing NTFS file system types. Stream type specifier values always start with the dollar sign ($) symbol. See WIN32_STREAM_ID for a list of stream types.

By default, the default data stream is unnamed. To specify the default data stream from the command line, type "filename::$STREAM_TYPE", where STREAM_TYPE is the stream type (such as $DATA), or simply type filename. You can create a named stream in the file using the file naming conventions. Note that "$DATA" is a legal name. For example, the full name would be sample:$DATA:$DATA. If you created a stream named "bar" its full name would be sample:bar:$DATA.

When creating and working with files that have one-character names, prefix the file name with period followed by a backslash (.\) or a fully qualified path name. The reason to do this is that Windows treats one-character file names as drive letters. When a drive letter is specified with a relative path, a colon separates the drive letter from the path. When there is an ambiguity about whether a one-character name is a drive letter or a file name, Windows assumes it is a a drive letter if the string following the colon is a valid path, even if the drive letter is invalid.

Naming Conventions for Streams

See Also