@FILESIZE and NTFS File Stream

[Joe Caverly]

     _x64: 1
   _admin: 1
_elevated: 1

TCC  27.00.18 x64   Windows 10 [Version 10.0.18363.1256]

I would like to get the filesize of an NTFS File Stream.

e:\utils>dir /: EncodeEXE.btm

 Volume in drive E is New Volume   Serial number is 2c1e:6e61
 Directory of  E:\Utils\EncodeEXE.btm

2021-01-02   5:54             868  EncodeEXE.btm
                            5,614    timer.b64:$DATA

When I use;

e:\utils>echo %@filesize[EncodeEXE.btm:timer.b64]
868

it does not return 5,614 which is the size of the stream.

If I use @FILEOPEN/@FILESEEK it returns the correct size of the stream.

set hnd=%@fileopen[EncodeEXE.btm:timer.b64,r]
set thesize=%@FILESEEK[%hnd,0,2]
echo %thesize
echo %@fileclose[%hnd]

5614

Why does @FILESIZE not return the correct size of a NTFS stream?

Joe

 

[rconn]

Why does @FILESIZE not return the correct size of a NTFS stream?

Because the Windows API that TCC uses doesn't return stream sizes.

And until today, nobody's ever asked for @FILESIZE to do that.