File Streams (Local File Systems)

A stream is a sequence of bytes. In the NTFS file system, streams contain the data that is written to a file, and that gives more information about a file than attributes and properties. For example, you can create a stream that contains search keywords, or the identity of the user account that creates a file.

Each stream that is associated with a file has its own allocation size, actual size, and valid data length:

• The allocation size is the amount of disk space that is reserved for a stream.
• The actual size is the number of bytes that are being used by a caller.
• The valid data length (VDL) is the number of bytes that are initialized from the allocation size for the stream.

Each stream also maintains its own state for compression, encryption, and sparseness. The FILE_ATTRIBUTE_SPARSE_FILE attribute on the file is set in the dwFileAttributes member of the WIN32_FIND_DATA structure returned from the FindFirstFile, FindFirstFileEx, and FindNextFile functions if any of the streams have ever been sparse. GetFileAttributes, GetFileAttributesEx, GetFileAttributesTransacted, GetFileInformationByHandle, and GetFileInformationByHandleEx return the sparse state of the default data stream if no stream is specified.

There are no file times associated with a stream. The file times for a file are updated when any stream in a file is updated.

Opportunistic locks are maintained per stream. Sharing modes are also maintained per stream. When delete access is requested on a file, the operating system checks for delete access on all open streams in a file. If another process has opened a stream without the FILE_SHARE_DELETE permission, you cannot open the file for delete access.

If a file being copied has a data stream and the network redirector is used, the file can only be copied if the client has both the read permission and the read attributes permission.

Naming Conventions for Streams

When specified from the Windows shell command line, the full name of a stream is "filename:stream name:stream type", as in the following example: "myfile.dat:stream1:$DATA".

Any characters that are legal for a file name are also legal for the stream name, including spaces. For more information, see Naming a File. The stream type (also called an attribute type code) is internal to the NTFS file system. Users therefore can't create new stream types, but they can open existing NTFS file system types. Stream type specifier values always start with the dollar sign ($) symbol. See below for a list of stream types.

By default, the default data stream is unnamed. To fully specify the default data stream, use "filename::$DATA", where $DATA is the stream type. This is the equivalent of "filename". You can create a named stream in the file using the file naming conventions. Note that "$DATA" is a legal stream name. For example, the full name of a stream named "$DATA" on a file named "sample" would be "sample:$DATA:$DATA". If you created a stream named "bar" on the same file its full name would be "sample:bar:$DATA".

When creating and working with files that have one-character names, prefix the file name with period followed by a backslash (.) or use a fully qualified path name. The reason to do this is that Windows treats one-character file names as drive letters. When a drive letter is specified with a relative path, a colon separates the drive letter from the path. When there is an ambiguity about whether a one-character name is a drive letter or a file name, Windows assumes it is a drive letter if the string following the colon is a valid path, even if the drive letter is invalid.

Stream Types

Following is the list of NTFS stream types, also called attribute type codes. Some of the stream types are internal to NTFS and their format is undocumented.

Related topics

Using Streams