5 Appendix A: Product Behavior

The information in this specification is applicable to the following Microsoft products or supplemental software. References to product versions include updates to those products.

  • Windows 2000 operating system

  • Windows XP operating system

  • Windows Server 2003 operating system

  • Windows Vista operating system

  • Windows Server 2008 operating system

  • Windows 7 operating system

  • Windows Server 2008 R2 operating system

  • Windows 8 operating system

  • Windows Server 2012 operating system

  • Windows 8.1 operating system

  • Windows Server 2012 R2 operating system

  • Windows 10 operating system

  • Windows Server 2016 operating system

  • Windows Server operating system 

Exceptions, if any, are noted in this section. If an update version, service pack or Knowledge Base (KB) number appears with a product name, the behavior changed in that update. The new behavior also applies to subsequent updates unless otherwise specified. If a product edition appears with the product version, behavior is different in that product edition.

Unless otherwise specified, any statement of optional behavior in this specification that is prescribed using the terms "SHOULD" or "SHOULD NOT" implies product behavior in accordance with the SHOULD or SHOULD NOT prescription. Unless otherwise specified, the term "MAY" implies that the product does not follow the prescription.

<1> Section 2.1.1.1: NTFS uses a default cluster size of 4 KB, a maximum cluster size of 64 KB, and a minimum cluster size of 512 bytes. ReFS in Windows 8 and subsequent use a fixed cluster size of 64 KB. ReFS in Windows 10, Windows Server 2016, and Windows Server operating system use a default cluster size of 4 KB. ReFS also supports a 64-KB cluster size.

<2> Section 2.1.1.1: For AMD64, x86, and ARM systems, this value is 4 KB. For ia64 systems, this value is 8 KB.

<3> Section 2.1.1.1: In NTFS, the CompressionUnitSize is 64 KB for encrypted files, 64 KB for sparse files, and the lesser of 64 KB or (16 * ClusterSize) for compressed files. Other file systems do not implement this field.

<4> Section 2.1.1.1: In NTFS, the CompressedChunkSize is 4 KB. Other Windows file systems do not implement this field.

<5> Section 2.1.1.1: Only ReFS supports integrity.

<6> Section 2.1.1.1: Only NTFS supports quotas.

<7> Section 2.1.1.1: This field is present for compatibility with the file level FileObjectIdInformation structure ([MS-FSCC] section 2.4.28). These fields are not currently used by Windows and always contain zeroes.

<8> Section 2.1.1.1: The USN journal is supported on ReFS all versions and NTFS version 3.0 volumes or greater. The USN journal is active by default on Windows Vista and subsequent. The USN journal is not active by default on Windows-based servers.

<9> Section 2.1.1.1: For Windows 2000, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2, the maximum file size of a file on an NTFS volume is the smaller of (232 – 1) * cluster size, and 16 terabytes (TB). For Windows 8 and Windows Server 2012, the maximum file size of a file on an NTFS volume is (232 – 1) * cluster size. For Windows 8.1 and subsequent the maximum file size of a file on an NTFS volume is (((232 * cluster size) – 64K). For example, if the cluster size is 512 bytes, the maximum file size is 2 TB.

<10> Section 2.1.1.2: ReFS does not implement the TunnelCache.

<11> Section 2.1.1.3:  Only NTFS supports view index files.

<12> Section 2.1.1.3: ReFS and exFAT do not implement ShortNames.

<13> Section 2.1.1.3: The following table defines the support of file time stamps across various Windows file systems. More information can be found in section 6 of the File System Behavior Overview document [FSBO].

Timestamp

ReFS

NTFS

FAT

EXFAT

UDFS

CreationTime

Stored in UTC

100 nanosecond granularity

Stored in UTC

100 nanosecond granularity

Stored in local time

10 millisecond granularity

Stored in UTC if available, else in local time

10 millisecond granularity

Stored in UTC if available, else in local time

1 microsecond granularity

LastAccessTime

Stored in UTC

100 nanosecond granularity

Updated at 60 minute granularity

Stored in UTC

100 nanosecond granularity

Updated at 60 minute granularity

Stored in local time

1 day granularity

Stored in UTC if available, else in local time

2 second granularity

Stored in UTC if available, else in local time

1 microsecond granularity

ChangeTime

Stored in UTC

100 nanosecond granularity

Stored in UTC

100 nanosecond granularity

Not Supported

Not Supported

Stored in UTC if available, else in local time

1 microsecond granularity

LastWriteTime

Stored in UTC

100 nanosecond granularity

Stored in UTC

100 nanosecond granularity

Stored in local time

2 second granularity

Stored in UTC if available, else in local time

10 millisecond granularity

Stored in UTC if available, else in local time

1 microsecond granularity

<14> Section 2.1.1.3: The following table defines the support of file time stamps across various Windows file systems. More information can be found in section 6 of the File System Behavior Overview document [FSBO].

Timestamp

ReFS

NTFS

FAT

EXFAT

UDFS

CreationTime

Stored in UTC

100 nanosecond granularity

Stored in UTC

100 nanosecond granularity

Stored in local time

10 millisecond granularity

Stored in UTC if available, else in local time

10 millisecond granularity

Stored in UTC if available, else in local time

1 microsecond granularity

LastAccessTime

Stored in UTC

100 nanosecond granularity

Updated at 60 minute granularity

Stored in UTC

100 nanosecond granularity

Updated at 60 minute granularity

Stored in local time

1 day granularity

Stored in UTC if available, else in local time

2 second granularity

Stored in UTC if available, else in local time

1 microsecond granularity

ChangeTime

Stored in UTC

100 nanosecond granularity

Stored in UTC

100 nanosecond granularity

Not Supported

Not Supported

Stored in UTC if available, else in local time

1 microsecond granularity

LastWriteTime

Stored in UTC

100 nanosecond granularity

Stored in UTC

100 nanosecond granularity

Stored in local time

2 second granularity

Stored in UTC if available, else in local time

10 millisecond granularity

Stored in UTC if available, else in local time

1 microsecond granularity

<15> Section 2.1.1.3: The following table defines the support of file time stamps across various Windows file systems. More information can be found in section 6 of the File System Behavior Overview document [FSBO].

Timestamp

ReFS

NTFS

FAT

EXFAT

UDFS

CreationTime

Stored in UTC

100 nanosecond granularity

Stored in UTC

100 nanosecond granularity

Stored in local time

10 millisecond granularity

Stored in UTC if available, else in local time

10 millisecond granularity

Stored in UTC if available, else in local time

1 microsecond granularity

LastAccessTime

Stored in UTC

100 nanosecond granularity

Updated at 60 minute granularity

Stored in UTC

100 nanosecond granularity

Updated at 60 minute granularity

Stored in local time

1 day granularity

Stored in UTC if available, else in local time

2 second granularity

Stored in UTC if available, else in local time

1 microsecond granularity

ChangeTime

Stored in UTC

100 nanosecond granularity

Stored in UTC

100 nanosecond granularity

Not Supported

Not Supported

Stored in UTC if available, else in local time

1 microsecond granularity

LastWriteTime

Stored in UTC

100 nanosecond granularity

Stored in UTC

100 nanosecond granularity

Stored in local time

2 second granularity

Stored in UTC if available, else in local time

10 millisecond granularity

Stored in UTC if available, else in local time

1 microsecond granularity

<16> Section 2.1.1.3: In Windows Vista and subsequent, LastAccessTime updates are disabled by default in the ReFS and NTFS file systems. It is only updated when the file is closed. This behavior is controlled by the following registry key: HKLM\System\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate. A nonzero value means LastAccessTime updates are disabled. A value of zero means they are enabled.

<17> Section 2.1.1.3: The following table defines the support of file time stamps across various Windows file systems. More information can be found in section 6 of the File System Behavior Overview document [FSBO].

Timestamp

ReFS

NTFS

FAT

EXFAT

UDFS

CreationTime

Stored in UTC

100 nanosecond granularity

Stored in UTC

100 nanosecond granularity

Stored in local time

10 millisecond granularity

Stored in UTC if available, else in local time

10 millisecond granularity

Stored in UTC if available, else in local time

1 microsecond granularity

LastAccessTime

Stored in UTC

100 nanosecond granularity

Updated at 60 minute granularity

Stored in UTC

100 nanosecond granularity

Updated at 60 minute granularity

Stored in local time

1 day granularity

Stored in UTC if available, else in local time

2 second granularity

Stored in UTC if available, else in local time

1 microsecond granularity

ChangeTime

Stored in UTC

100 nanosecond granularity

Stored in UTC

100 nanosecond granularity

Not Supported

Not Supported

Stored in UTC if available, else in local time

1 microsecond granularity

LastWriteTime

Stored in UTC

100 nanosecond granularity

Stored in UTC

100 nanosecond granularity

Stored in local time

2 second granularity

Stored in UTC if available, else in local time

10 millisecond granularity

Stored in UTC if available, else in local time

1 microsecond granularity

<18> Section 2.1.1.3: Only NTFS implements EAs.

<19> Section 2.1.1.3: Only NTFS implements EAs.

<20> Section 2.1.1.3: Only NTFS implements object IDs.

<21> Section 2.1.1.3: Only NTFS implements object IDs.

<22> Section 2.1.1.3: Only NTFS and UDFS implement named streams.

<23> Section 2.1.1.3: ReFS and exFAT do not implement ShortNames.

<24> Section 2.1.1.3: Only NTFS implements encryption.

<25> Section 2.1.1.4: For ReFS, there will always be exactly one link per file or directory.

<26> Section 2.1.1.4: On ReFS or exFAT, this field MUST be empty.

<27> Section 2.1.1.4:  The following table defines the support of file time stamps across various Windows file systems. More information can be found in section 6 of the File System Behavior Overview document [FSBO].

Timestamp

ReFS

NTFS

FAT

EXFAT

UDFS

CreationTime

Stored in UTC

100 nanosecond granularity

Stored in UTC

100 nanosecond granularity

Stored in local time

10 millisecond granularity

Stored in UTC if available, else in local time

10 millisecond granularity

Stored in UTC if available, else in local time

1 microsecond granularity

LastAccessTime

Stored in UTC

100 nanosecond granularity

Updated at 60 minute granularity

Stored in UTC

100 nanosecond granularity

Updated at 60 minute granularity

Stored in local time

1 day granularity

Stored in UTC if available, else in local time

2 second granularity

Stored in UTC if available, else in local time

1 microsecond granularity

ChangeTime

Stored in UTC

100 nanosecond granularity

Stored in UTC

100 nanosecond granularity

Not Supported

Not Supported

Stored in UTC if available, else in local time

1 microsecond granularity

LastWriteTime

Stored in UTC

100 nanosecond granularity

Stored in UTC

100 nanosecond granularity

Stored in local time

2 second granularity

Stored in UTC if available, else in local time

10 millisecond granularity

Stored in UTC if available, else in local time

1 microsecond granularity

<28> Section 2.1.1.4:  The following table defines the support of file time stamps across various Windows file systems. More information can be found in section 6 of the File System Behavior Overview document [FSBO].

Timestamp

ReFS

NTFS

FAT

EXFAT

UDFS

CreationTime

Stored in UTC

100 nanosecond granularity

Stored in UTC

100 nanosecond granularity

Stored in local time

10 millisecond granularity

Stored in UTC if available, else in local time

10 millisecond granularity

Stored in UTC if available, else in local time

1 microsecond granularity

LastAccessTime

Stored in UTC

100 nanosecond granularity

Updated at 60 minute granularity

Stored in UTC

100 nanosecond granularity

Updated at 60 minute granularity

Stored in local time

1 day granularity

Stored in UTC if available, else in local time

2 second granularity

Stored in UTC if available, else in local time

1 microsecond granularity

ChangeTime

Stored in UTC

100 nanosecond granularity

Stored in UTC

100 nanosecond granularity

Not Supported

Not Supported

Stored in UTC if available, else in local time

1 microsecond granularity

LastWriteTime

Stored in UTC

100 nanosecond granularity

Stored in UTC

100 nanosecond granularity

Stored in local time

2 second granularity

Stored in UTC if available, else in local time

10 millisecond granularity

Stored in UTC if available, else in local time

1 microsecond granularity

<29> Section 2.1.1.4:  The following table defines the support of file time stamps across various Windows file systems. More information can be found in section 6 of the File System Behavior Overview document [FSBO].

Timestamp

ReFS

NTFS

FAT

EXFAT

UDFS

CreationTime

Stored in UTC

100 nanosecond granularity

Stored in UTC

100 nanosecond granularity

Stored in local time

10 millisecond granularity

Stored in UTC if available, else in local time

10 millisecond granularity

Stored in UTC if available, else in local time

1 microsecond granularity

LastAccessTime

Stored in UTC

100 nanosecond granularity

Updated at 60 minute granularity

Stored in UTC

100 nanosecond granularity

Updated at 60 minute granularity

Stored in local time

1 day granularity

Stored in UTC if available, else in local time

2 second granularity

Stored in UTC if available, else in local time

1 microsecond granularity

ChangeTime

Stored in UTC

100 nanosecond granularity

Stored in UTC

100 nanosecond granularity

Not Supported

Not Supported

Stored in UTC if available, else in local time

1 microsecond granularity

LastWriteTime

Stored in UTC

100 nanosecond granularity

Stored in UTC

100 nanosecond granularity

Stored in local time

2 second granularity

Stored in UTC if available, else in local time

10 millisecond granularity

Stored in UTC if available, else in local time

1 microsecond granularity

<30> Section 2.1.1.4:  In Windows Vista and subsequent LastAccessTime updates are disabled by default in the ReFS and NTFS file systems. It is only updated when the file is closed. This behavior is controlled by the following registry key: HKLM\System\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate. A nonzero value means LastAccessTime updates are disabled. A value of zero means they are enabled.

<31> Section 2.1.1.4:  The following table defines the support of file time stamps across various Windows file systems. More information can be found in section 6 of the File System Behavior Overview document [FSBO].

Timestamp

ReFS

NTFS

FAT

EXFAT

UDFS

CreationTime

Stored in UTC

100 nanosecond granularity

Stored in UTC

100 nanosecond granularity

Stored in local time

10 millisecond granularity

Stored in UTC if available, else in local time

10 millisecond granularity

Stored in UTC if available, else in local time

1 microsecond granularity

LastAccessTime

Stored in UTC

100 nanosecond granularity

Updated at 60 minute granularity

Stored in UTC

100 nanosecond granularity

Updated at 60 minute granularity

Stored in local time

1 day granularity

Stored in UTC if available, else in local time

2 second granularity

Stored in UTC if available, else in local time

1 microsecond granularity

ChangeTime

Stored in UTC

100 nanosecond granularity

Stored in UTC

100 nanosecond granularity

Not Supported

Not Supported

Stored in UTC if available, else in local time

1 microsecond granularity

LastWriteTime

Stored in UTC

100 nanosecond granularity

Stored in UTC

100 nanosecond granularity

Stored in local time

2 second granularity

Stored in UTC if available, else in local time

10 millisecond granularity

Stored in UTC if available, else in local time

1 microsecond granularity

<32> Section 2.1.1.4:  Only NTFS implements EAs.

<33> Section 2.1.1.5:  Only NTFS supports view index streams.

<34> Section 2.1.1.5: Only NTFS supports compression.

<35> Section 2.1.1.5: Only ReFS supports integrity.

<36> Section 2.1.1.5: Only ReFS supports integrity.

<37> Section 2.1.1.5: Only NTFS, ReFS, and UDFS support sparse files.

<38> Section 2.1.1.5: Only NTFS supports encryption.

<39> Section 2.1.1.6: Only NTFS implements EAs.

<40> Section 2.1.4.11: NTFS sets RecordLength to BlockAlign(FieldOffset(USN_RECORD_V2.FileName) + FileNameLength, 8). ReFS sets RecordLength to BlockAlign(FieldOffset(USN_RECORD_V3.FileName) + FileNameLength, 8).

<41> Section 2.1.4.12:  Windows 2000 through Windows Server 2008 R2 do not perform any of the following checks because PARENT_OBJECT is never set in the Flags field so you will always take the ELSE statement to the SWITCH statement.

Windows 8 and Windows Server 2012 will perform the following checks before the Switch(Operation) statement:

  • If Flags contains PARENT_OBJECT:

    • If Operation is OPEN, as specified in section 2.1.5.1, or

      Operation is FLUSH_DATA, as specified in section 2.1.5.6, or

      Operation is CLOSE, as specified in section 2.1.5.4, or

      Operation is FS_CONTROL, as specified in section 2.1.5.9, and OpParams.ControlCode is FSCTL_SET_ENCRYPTION, or

      Operation is SET_INFORMATION, as specified in section 2.1.5.14, and OpParams.FileInformationClass is one of FileBasicInformation or FileAllocationInformation or FileEndOfFileInformation or FileRenameInformation or FileLinkInformation or FileShortNameInformation or FileValidDataLengthInformation.

      • Set BreakCacheLevel to (READ_CACHING|WRITE_CACHING).

  • Else:

    • Switch (Operation):

<42> Section 2.1.5.1:  NTFS and ReFS recognize the following complex name suffixes:

§ ":$I30"

§ "::$INDEX_ALLOCATION"

§ ":$I30:$INDEX_ALLOCATION"

§ "::$BITMAP"

§ ":$I30:$BITMAP"

§ "::$ATTRIBUTE_LIST"

§ "::$REPARSE_POINT"

Other Windows file systems do not recognize any complex name suffixes.

<43> Section 2.1.5.1: NTFS and ReFS recognize the following stream type names:

  • "$STANDARD_INFORMATION"

  • "$ATTRIBUTE_LIST"

  • "$FILE_NAME"

  • "$OBJECT_ID"

  • "$SECURITY_DESCRIPTOR"

  • "$VOLUME_NAME"

  • "$VOLUME_INFORMATION"

  • "$DATA"

  • "$INDEX_ROOT"

  • "$INDEX_ALLOCATION"

  • "$BITMAP"

  • "$REPARSE_POINT"

  • "$EA_INFORMATION"

  • "$EA"

  • "$LOGGED_UTILITY_STREAM"

Other Windows file systems do not recognize any stream type names.

<44> Section 2.1.5.1.1: For the NTFS file system, the FileId128 consists of a 48-bit index into the MFT (the low 48 bits) and a 16-bit sequence number (the next higher 16 bits), with the high 64 bits unused and always equal to 0. For the ReFS file system, the FileId128 consists of a 64-bit index uniquely identifying the file's parent directory on the volume (the low 64 bits) and a 64-bit index uniquely identifying the file within that directory (the high 64 bits).

<45> Section 2.1.5.1.1: For the NTFS file system this is the index and sequence number portions (low 64 bits) of the FileId128.  The ReFS file system maps a subset of the possible FileId128 values to FileId64 values using a reversible algorithm; for values outside of this subset, ReFS sets the FileId64 to -1.

<46> Section 2.1.5.1.1: For the NTFS file system, this is the index portion (low 48 bits) of the FileId128. The ReFS file system does not implement this field.

<47> Section 2.1.5.1.1: Only ReFS supports FILE_ATTRIBUTE_INTEGRITY_STREAM.

<48> Section 2.1.5.1.1: Only NTFS and ReFS support FILE_ATTRIBUTE_NO_SCRUB_DATA.

<49> Section 2.1.5.1.1: Only NTFS and UDFS implement named streams.

<50> Section 2.1.5.1.2: Windows 2000, Windows XP, Windows Server 2003, and Windows Vista, treat the FILE_DISALLOW_EXCLUSIVE option as always being FALSE.

<51> Section 2.1.5.5.1: This is implemented only by the NTFS file system.

<52> Section 2.1.5.5.1: This directory is only available on NTFS volumes formatted to NTFS version 3.0 or late.

<53> Section 2.1.5.5.1: "*" is treated as 0x0000002A during the search, and it gives the practical behavior of a wildcard since an ObjectId starts with a much larger value. Similarly, "?" is treated as 0x0000003F and so practically it behaves like "*".

<54> Section 2.1.5.5.2: This is implemented only by the NTFS file system. This is not implemented on the FAT32 file system and STATUS_INVALID_PARAMETER will be returned.

<55> Section 2.1.5.5.2: This directory is only available on NTFS volumes formatted to NTFS version 3.x.

<56> Section 2.1.5.5.3: Windows Vista operating system with Service Pack 1 (SP1), Windows Server 2008, Windows 7, and Windows Server 2008 R2 execute this portion only when FirstQuery is TRUE; the remaining conditions are ignored. This means the query pattern for a given Open cannot be changed once it is set.

<57> Section 2.1.5.5.3.1: For ReFS, this value MUST be zero.

<58> Section 2.1.5.5.3.3: For ReFS, this value MUST be zero.

<59> Section 2.1.5.5.3.4: For ReFS, this value MUST be zero.

<60> Section 2.1.5.5.3.5: For ReFS, this value MUST be zero.

<61> Section 2.1.5.6: This is only implemented by the NTFS file system. Other file systems return STATUS_SUCCESS and perform no other action.

<62> Section 2.1.5.7:  In Windows 2000, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2, NTFS checks for an oplock break even when (FileOffset >= Open.Stream.AllocationSize).

<63> Section 2.1.5.9.1: This is only implemented by the NTFS file system.

<64> Section 2.1.5.9.1: If the generated ObjectId collides with existing ObjectIds on the volume, Windows retries up to 16 times before failing the operation with STATUS_DUPLICATE_NAME.

<65> Section 2.1.5.9.1: The file system only updates LastChangeTime if no user has explicitly set LastChangeTime. The NTFS and ReFS file systems defer setting LastChangeTime until the handle is closed.

<66> Section 2.1.5.9.2: This is only implemented by the NTFS file system.

<67> Section 2.1.5.9.2: The file system only updates LastChangeTime if no user has explicitly set LastChangeTime. The NTFS and ReFS file systems defer setting LastChangeTime until the handle is closed.

<68> Section 2.1.5.9.3: This is only implemented by the NTFS file system.

<69> Section 2.1.5.9.3: The file system only updates LastChangeTime if no user has explicitly set LastChangeTime. The NTFS and ReFS file systems defer setting LastChangeTime until the handle is closed.

<70> Section 2.1.5.9.4: FSCTL_DUPLICATE_EXTENTS_TO_FILE is only supported by the ReFS file system in Windows 10, Windows Server 2016, and Windows Server operating system.

<71> Section 2.1.5.9.4:  Windows returns STATUS_INVALID_HANDLE if the source file handle is closed.

<72> Section 2.1.5.9.4:  The ReFS file system in Windows Server 2016 and Windows Server operating system does not check for byte range lock conflicts on Open.Stream.

<73> Section 2.1.5.9.4:  The ReFS file system in Windows Server 2016 and Windows Server operating system does not check for byte range lock conflicts on Source.

<74> Section 2.1.5.9.5: If the Open is a directory on a Cluster Shared Volume File System (CSVFS), the operation MUST be failed with STATUS_NOT_IMPLEMENTED.

<75> Section 2.1.5.9.6: This is only implemented by the ReFS, NTFS, FAT, FAT32, and exFAT file systems.

<76> Section 2.1.5.9.6: The NTFS file system sets an NTFS_STATISTICS structure as specified in [MS-FSCC] section 2.3.10.2. The FAT file system sets a FAT_STATISTICS structure as specified in [MS-FSCC] section 2.3.10.3. The EXFAT file system sets a EXFAT_STATISTICS structure as specified in [MS-FSCC] section 2.3.10.4.

<77> Section 2.1.5.9.7: This is only implemented by the NTFS file system.

<78> Section 2.1.5.9.7: Some file systems have more efficient mechanisms to obtain a list of files. For instance, NTFS iterates through all base file records of the MFT.

<79> Section 2.1.5.9.8: This is only implemented by the NTFS and ReFS file systems.

<80> Section 2.1.5.9.9: This operation is only implemented by the ReFS file system.

<81> Section 2.1.5.9.10: This is only implemented by the NTFS file system.

<82> Section 2.1.5.9.10: Several of the fields being set in this section are specific to how the NTFS file system is implemented and are not defined in the Object Stores Abstract Data Model.

<83> Section 2.1.5.9.12: This is only implemented by the NTFS file system.

<84> Section 2.1.5.9.13: This is only implemented by the ReFS and NTFS file systems.

<85> Section 2.1.5.9.16: This is implemented only by the NTFS file system.

<86> Section 2.1.5.9.17: This is implemented only by the NTFS file system.

<87> Section 2.1.5.9.18: This is only implemented by the ReFS and NTFS file systems.

<88> Section 2.1.5.9.19: Support for this FSCTL is only implemented in the FAT file system. The data returned by this FSCTL is incomplete and incorrect on FAT32, and it is unsupported on all other file systems, as specified in [MS-FSCC] section 2.3.41.

<89> Section 2.1.5.9.21: This is only implemented by the UDFS file system.

<90> Section 2.1.5.9.22: This is only implemented by the UDFS file system.

<91> Section 2.1.5.9.23: This is only implemented by the ReFS and NTFS file systems.

<92> Section 2.1.5.9.23: In Windows 2000, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8, and Windows Server 2012, NTFS uses a MaxMajorVersionSupported value of 2.

<93> Section 2.1.5.9.23: In Windows 2000, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7 and Windows Server 2008 R2, NTFS ignores the input buffer completely; all requests are treated as having an InputBufferSize of 0.

<94> Section 2.1.5.9.23: In Windows 8 and Windows Server 2012, the operation MUST be failed with STATUS_NOT_IMPLEMENTED.

<95> Section 2.1.5.9.24: This file system request is handled by the optional hierarchical storage management (HSM) file system filter. This filter has been deprecated as of Windows Server 2008 and is a server-only feature.

<96> Section 2.1.5.9.25: If the Open is a directory on a Cluster Shared Volume File System (CSVFS), the operation MUST be failed with STATUS_NOT_IMPLEMENTED.

<97> Section 2.1.5.9.25: This method is fully supported with NTFS, but for ReFS, it is only supported and returns STATUS_SUCCESS when CompressionState is set to COMPRESSION_FORMAT_NONE. The method fails with STATUS_NOT_SUPPORTED for any other value of CompressionState.

<98> Section 2.1.5.9.25: NTFS File Compression can be disabled globally on a system by setting the registry key HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableCompression to 1 and then rebooting the system to have the change take effect. Compression can be re-enabled by setting this key to zero and rebooting the system.

<99> Section 2.1.5.9.26: This is only implemented by the UDFS file system on media types that require software defect management.

<100> Section 2.1.5.9.27: This is implemented by the NTFS file system and the FAT32 file systems on Windows 10 v1511 operating system, Windows Server 2016 and subsequent.

<101> Section 2.1.5.9.28: Only ReFS supports integrity.

<102> Section 2.1.5.9.28: If the Open is a directory on a Cluster Shared Volume File System (CSVFS), the operation MUST be failed with STATUS_NOT_IMPLEMENTED.

<103> Section 2.1.5.9.28: This is implemented only by the ReFS file system.

<104> Section 2.1.5.9.29: This is only implemented by the NTFS file system.

<105> Section 2.1.5.9.29: The file system only updates LastChangeTime if no user has explicitly set LastChangeTime. The NTFS and ReFS file systems defer setting LastChangeTime until the handle is closed.

<106> Section 2.1.5.9.30: This is only implemented by the NTFS file system.

<107> Section 2.1.5.9.30: The file system only updates LastChangeTime if no user has explicitly set LastChangeTime. The NTFS and ReFS file systems defer setting the LastChangeTime until the handle is closed.

<108> Section 2.1.5.9.31: This is only implemented by the ReFS and NTFS file systems. The FAT32 file system will return STATUS_IO_REPARSE_DATA_INVALID.

<109> Section 2.1.5.9.31: The file system only updates LastChangeTime if no user has explicitly set LastChangeTime. The NTFS and ReFS file systems defer setting the LastChangeTime until the handle is closed.

<110> Section 2.1.5.9.32: WinPE stands for the Windows Preinstallation Environment. For more information please see [MSFT-WinPE].

<111> Section 2.1.5.9.33: If the Open is a directory on a Cluster Shared Volume File System (CSVFS), the operation MUST be failed with STATUS_NOT_IMPLEMENTED.

<112> Section 2.1.5.9.33: This is only implemented by the NTFS file system and by the ReFS file system on non-integrity streams. In Windows 8.1 and subsequent, ReFS supports this for both conventional and integrity streams.

<113> Section 2.1.5.9.34: If the Open is a directory on a Cluster Shared Volume File System (CSVFS), the operation MUST be failed with STATUS_NOT_IMPLEMENTED.

<114> Section 2.1.5.9.34: This is only implemented by the NTFS file system and by the ReFS file system on non-integrity streams. In Windows 8.1 and subsequent, ReFS supports this for both conventional and integrity streams.

<115> Section 2.1.5.9.35: This is only implemented by the NTFS file system and FAT32 file system on Windows 10 v1511, Windows Server 2016 and subsequent.

<116> Section 2.1.5.9.36: [SIS] (Single Instance Storage) is an optional feature available in the following versions of Windows Server: Windows Storage Server 2003 R2 operating system, Standard Edition, Windows Storage Server 2008, and Windows Storage Server 2008 R2. [SIS] is not supported directly by any of the Windows file systems but is implemented as a file system filter. Please refer to the following article for detailed information about [SIS].

<117> Section 2.1.5.9.36: This is implemented only by the NTFS file system. The FAT32 file system will return STATUS_NOT_SUPPORTED.

<118> Section 2.1.5.9.36: In the Windows environment file system are implemented in kernel mode. If a NULL security context is specified and the originator of the operation is running in kernel mode, a built-in SYSTEM security context is used that grants all access.

<119> Section 2.1.5.9.36: In the Windows environment file system are implemented in kernel mode. If a NULL security context is specified and the originator of the operation is running in kernel mode, a built-in SYSTEM security context is used that grants all access.

<120> Section 2.1.5.9.36: In the Windows environment this is done by creating a new file in what is known as the "SIS Common Store". Reparse points are attached to any file controlled by [SIS] that contains information on how to access the Common Store file that contains the data for this file. Please see the following article about [SIS] for details on how this is implemented.

<121> Section 2.1.5.9.37: This is only implemented by the NTFS file system.

<122> Section 2.1.5.11.5: Only ReFS supports integrity.

<123> Section 2.1.5.11.5: Only ReFS supports integrity.

<124> Section 2.1.5.11.6: Only ReFS supports integrity.

<125> Section 2.1.5.11.6: Only ReFS supports integrity.

<126> Section 2.1.5.11.8:  The FAT32 file system doesn’t support FILE_COMPRESSION_INFORMATION and will return STATUS_INVALID_PARAMETER.

<127> Section 2.1.5.11.10: Only the NTFS file system implements EAs.

<128> Section 2.1.5.11.12: This operation is only supported by the NTFS file system.

<129> Section 2.1.5.11.21: Available only in ReFS.

<130> Section 2.1.5.11.21: Available only in ReFS.

<131> Section 2.1.5.11.23: If Open.Mode contains neither FILE_SYNCHRONOUS_IO_ALERT nor FILE_SYNCHRONOUS_IO_NONALERT, this operation does not return meaningful information in OutputBuffer.CurrentByteOffset, because Open.CurrentByteOffset is not maintained for any Open that does not have either of those flags set.

<132> Section 2.1.5.11.27: This algorithm is only implemented by NTFS and ReFS. The FAT, EXFAT, CDFS, and UDFS file systems always return 1.

<133> Section 2.1.5.11.29:  The FAT32 file system doesn’t support FILE_STREAM_INFORMATION and will return STATUS_INVALID_PARAMETER.

<134> Section 2.1.5.12.5: The following table defines what FileSystemAttributes flags, as defined in [MS-FSCC] section 2.5.1, are set by various Windows file systems and why they are set:

ReFS

NTFS

FAT

EXFAT

UDFS

CDFS

FILE_SUPPORTS_USN_JOURNAL

0x02000000

Always Set

Set if 3.0 format or higher volume

FILE_SUPPORTS_OPEN_BY_FILE_ID

0x01000000

Always Set

Always Set

Set if volume mounted read-only

Always Set

FILE_SUPPORTS_EXTENDED_ATTRIBUTES

0x00800000

Always Set

FILE_SUPPORTS_HARD_LINKS

0x00400000

Always Set

Always Set

FILE_SUPPORTS_TRANSACTIONS

0x00200000

Set if 3.0 format or higher volume

FILE_SEQUENTIAL_WRITE_ONCE

0x00100000

Set if volume not mounted read-only

FILE_READ_ONLY_VOLUME

0x00080000

Set if volume mounted read-only

Set if volume mounted read-only

Set if volume mounted read-only

Set if volume mounted read-only

Set if volume mounted read-only

Always Set

FILE_NAMED_STREAMS

0x00040000

Always Set

Set if 2.0 format or higher

FILE_SUPPORTS_ENCRYPTION

0x00020000

Set if 3.0 format or higher volume and encryption is enabled on the system

FILE_SUPPORTS_OBJECT_IDS

0x00010000

Set if 3.0 format or higher volume

FILE_VOLUME_IS_COMPRESSED

0x00008000

FILE_SUPPORTS_REMOTE_STORAGE

0x00000100

FILE_SUPPORTS_REPARSE_POINTS

0x00000080

Always Set

Set if 3.0 format or higher volume

FILE_SUPPORTS_SPARSE_FILES

0x00000040

Set if 3.0 format or higher volume

FILE_VOLUME_QUOTAS

0x00000020

Set if 3.0 format or higher volume

FILE_FILE_COMPRESSION

0x00000010

Set if volume cluster size is 4K or less

FILE_PERSISTENT_ACLS

0x00000008

Always Set

Always Set

FILE_UNICODE_ON_DISK

0x00000004

Always Set

Always Set

Always Set

Always Set

Always Set

Set if Joliet Format

FILE_CASE_PRESERVED_NAMES

0x00000002

Always Set

Always Set

Always Set

Always Set

Always Set

FILE_CASE_SENSITIVE_SEARCH

0x00000001

Always Set

Always Set

Always Set

Always Set

<135> Section 2.1.5.12.5: The following table defines the MaximumComponentNameLength, as defined in [MS-FSCC] section 2.5.1, that is set by each file system:

ReFS

NTFS

FAT

EXFAT

UDFS

CDFS

MaximumComponentNameLength Value

255

255

255

255

254

110 if Joliet Format

221 otherwise

<136> Section 2.1.5.12.6: This is implemented only by the NTFS file system.

<137> Section 2.1.5.12.8: ReFS does not implement object IDs.

<138> Section 2.1.5.12.8: This is implemented only by the NTFS file system.

<139> Section 2.1.5.14.1: The following table describes the maximum file size supported by various Windows File Systems.

ReFS

NTFS

FAT

EXFAT

UDFS

CDFS

MaximumFileSize

((2^32)-1) * ClusterSize

16 TB for Windows 2000, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2

(((2^32)-1) * ClusterSize) for Windows 8 and Windows Server 2012

(((2^32) * ClusterSize) - 64K) for Windows 8.1 and subsequent

The physical format will support 16 exabytes.

4 GB

16 exabytes

8 TB

8 TB

<140> Section 2.1.5.14.1:  The FAT, FAT32, exFAT, and UDFS file systems instead set NewFileSize to min(Open.Stream.Size, InputBuffer.AllocationSize).

<141> Section 2.1.5.14.2:  The FAT32 file system doesn’t process the ChangeTime field.

<142> Section 2.1.5.14.4:  The FAT32 file system will return STATUS_DISK_FULL if the object size is greater than 2^32 – 1 bytes.

<143> Section 2.1.5.14.4: The following table describes the maximum file size supported by various Windows File Systems.

ReFS

NTFS

FAT

EXFAT

UDFS

CDFS

MaximumFileSize

((2^32)-1) * ClusterSize

16 TB for Windows 2000, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2

(((2^32)-1) * ClusterSize) for Windows 8 and Windows Server 2012

(((2^32) * ClusterSize) - 64K) for Windows 8.1 and subsequent

The physical format will support 16 exabytes.

4 GB

16 exabytes

8 TB

8 TB

<144> Section 2.1.5.14.5: Only NTFS implements EAs.

<145> Section 2.1.5.14.9: If Open.Mode contains neither FILE_SYNCHRONOUS_IO_ALERT nor FILE_SYNCHRONOUS_IO_NONALERT, this operation does not have any meaningful effect, because Open.CurrentByteOffset is not used for any Open that does not have either of those flags set.

<146> Section 2.1.5.14.11: The file system only updates LastChangeTime if no user has explicitly set LastChangeTime. The NTFS and ReFS file systems defer setting LastChangeTime until the handle is closed.

<147> Section 2.1.5.14.13: ReFS does not implement short names.

<148> Section 2.1.5.14.14: ValidDataLength is an internal implementation detail of the NTFS, FAT, FAT32, ExFAT, and the ReFS file system. It is not a notion that exists in other Windows file systems. ValidDataLength refers to a high-watermark in the file that is considered to be initialized data by a user writing in the region or by the file system writing zeros. Any reads within that value are required to return data from the persistent store. Any reads beyond that value are required to return zeros. On the NTFS and ReFS file systems, when committing the file to media the value for ValidataLength is retained. The FAT, FAT32, and ExFAT file systems do not retain the value of ValidDataLength. FSCTL_QUERY_FILE_REGIONS, as specified in section 2.1.5.9.20, can be used to retrieve the value of ValidDataLength from the media but this FSCTL is only supported on NTFS and ReFS.

<149> Section 2.1.5.15.6: This is implemented only by the NTFS file system.

<150> Section 2.1.5.15.8: Only NTFS implements object IDs.

<151> Section 2.1.5.15.8: This is only implemented by the NTFS file system.

<152> Section 2.1.5.16:  The FAT32 file system will return ACCESS_DENIED.

<153> Section 2.1.5.16: The file system only updates LastChangeTime if no user has explicitly set LastChangeTime. The NTFS and ReFS file systems defer setting LastChangeTime until the handle is closed.

<154> Section 2.1.5.17: In Windows 2000, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2, NTFS does not grant the oplock even when Open.Stream.AllocationSize is greater than any ByteRangeLock.LockOffset in Open.Stream.ByteRangeLockList.

<155> Section 2.1.5.17: In Windows 2000, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2, NTFS does not grant the oplock even when Open.Stream.AllocationSize is greater than any ByteRangeLock.LockOffset in Open.Stream.ByteRangeLockList.

<156> Section 2.1.5.19: In Windows file systems, operations are only cancelable if they are blocked and put on a wait queue of some kind. Operations that are actively being processed are not cancelable.

<157> Section 2.1.5.20: The name of the quota file in the Windows environment is:

$Extend\$Quota:$Q:$INDEX_ALLOCATION

Opening the quota stream is only supported when the share is defined at the root of the volume.

<158> Section 2.1.5.20: This operation is implemented only by the NTFS file system.

<159> Section 2.1.5.21: The name of the quota file in the Windows environment is:

$Extend\$Quota:$Q:$INDEX_ALLOCATION

<160> Section 2.1.5.21: This operation is only implemented by the NTFS file system.

Show: