MFT DataSize, AllocatedSize and LastWriteTime

[Guest Matt]

Hi,

 

 

 

I'm writing some code that reads the FileName attribute file records from

 

the MFT by using the FSCTL_GET_NTFS_FILE_RECORD api call.

 

 

 

I've noticed that, for most records, the DataSize, AllocatedSize and

 

LastWriteTime are accurate when compared to the values in the win explorer

 

file properties dialog.However, for some more recent files/records the size

 

values are always 0 and the timestamp is incorrect.

 

 

 

Has anyone experienced this issue? I'm hoping to gain an understanding

 

of how/when NFTS updates the record with the correct values.

 

 

 

Thanks.

 

--

 

Matt