Jump to content
  • 1

Beware of DrivePool corruption / data leakage / file deletion / performance degradation scenarios Windows 10/11



To start, while new to DrivePool I love its potential I own multiple licenses and their full suite.  If you only use drivepool for basic file archiving of large files with simple applications accessing them for periodic reads it is probably uncommon you would hit these bugs.  This assumes you don't use any file synchronization / backup solutions.  Further, I don't know how many thousands (tens or hundreds?) of DrivePool users there are, but clearly many are not hitting these bugs or recognizing they are hitting these bugs, so this IT NOT some new destructive my files are 100% going to die issue.  Some of the reports I have seen on the forums though may be actually issues due to these things without it being recognized as such. As far as I know previously CoveCube was not aware of these issues, so tickets may not have even considered this possibility.

I started reporting these bugs to StableBit ~9 months ago, and informed I would be putting this post together ~1 month ago.  Please see the disclaimer below as well, as some of this is based on observations over known facts.

You are most likely to run into these bugs with applications that: *) Synchronize or backup files, including cloud mounted drives like onedrive or dropbox *) Applications that must handle large quantities of files or monitor them for changes like coding applications (Visual Studio/ VSCode)

Still, these bugs can cause silent file corruption, file misplacement, deleted files, performance degradation, data leakage ( a file shared with someone externally could have its contents overwritten by any sensitive file on your computer), missed file changes, and potential other issues for a small portion of users (I have had nearly all these things occur).  It may also trigger some BSOD crashes, I had one such crash that is likely related.  Due to the subtle nature some of these bugs can present with, it may be hard to notice they are happening even if they are.  In addition, these issues can occur even without file mirroring and files pinned to a specific drive.  I do have some potential workarounds/suggestions at the bottom.

More details are at the bottom but the important bug facts upfront:

  • Windows has a native file changed notification API using overlapped IO calls.  This allows an application to listen for changes on a folder, or a folder and sub folders, without having to constantly check every file to see if it changed.  Stablebit triggers "file changed" notifications even when files are just accessed (read) in certain ways.  Stablebit does NOT generate notification events on the parent folder when a file under it changes (Windows does).  Stablebit does NOT generate a notification event only when a FileID changes (next bug talks about FileIDs).


  • Windows, like linux, has a unique ID number for each file written on the hard drive.  If there are hardlinks to the same file, it has the same unique ID (so one File ID may have multiple paths associated with it). In linux this is called the inode number, Windows calls it the FileID.  Rather than accessing a file by its path, you can open a file by its FileID.  In addition it is impossible for two files to share the same FileID, it is a 128 bit number persistent across reboots (128 bits means the number of unique numbers represented is 39 digits long, or has the uniqueness of something like the MD5 hash).  A FileID does not change when a file moves or is modified.  Stablebit, by default, supports FileIDs however they seem to be ephemeral, they do not seem to survive across reboots or file moves.  Keep in mind FileIDs are used for directories as well, it is not just files. Further, if a directory is moved/renamed not only does its FileID change but every file under it changes. I am not sure if there are other situations in which they may change.  In addition, if a descendant file/directory FileID changes due to something like a directory rename Stablebit does NOT generate a notification event that it has changed (the application gets the directory event notification but nothing on the children).

There are some other things to consider as well, DrivePool does not implement the standard windows USN Journal (a system of tracking file changes on a drive).  It specifically identifies itself as not supporting this so applications shouldn't be trying to use it with a drivepool drive. That does mean that applications that traditionally don't use the file change notification API or the FileIDs may fall back to a combination of those to accomplish what they would otherwise use the USN Journal for (and this can exacerbate the problem).  The same is true of Volume Shadow Copy (VSS) where applications that might traditionally use this cannot (and drivepool identifies it cannot do VSS) so may resort to methods below that they do not traditionally use.

Now the effects of the above bugs may not be completely apparent:

  • For the overlapped IO / File change notification 

This means an application monitoring for changes on a DrivePool folder or sub-folder will get erroneous notifications files changed when anything even accesses them. Just opening something like file explorer on a folder, or even switching between applications can cause file accesses that trigger the notification. If an application takes actions on a notification and then checks the file at the end of the notification this in itself may cause another notification.  Applications that rely on getting a folder changed notification when a child changes will not get these at all with DrivePool.  If it isn't monitoring children at all just the folder, this means no notifications could be generated (vs just the child) so it could miss changes.

  • For FileIDs

It depends what the application uses the FileID for but it may assume the FileID should stay the same when a file moves, as it doesn't with DrivePool this might mean it reads or backs up, or syncs the entire file again if it is moved (perf issue).  An application that uses the Windows API to open a File by its ID may not get the file it is expecting or the file that was simply moved will throw an error when opened by its old FileID as drivepool has changed the ID.   For an example lets say an application caches that the FileID for ImportantDoc1.docx is 12345 but then 12345 refers to ImportantDoc2.docx due to a restart.  If this application is a file sync application and ImportantDoc1.docx is changed remotely when it goes to write those remote changes to the local file if it uses the OpenFileById method to do so it will actually override ImportantDoc2.docx with those changes.

I didn't spend the time to read Windows file system requirements to know when Windows expects a FileID to potentially change (or not change).  It is important to note that even if theoretical changes/reuse are allowed if they are not common place (because windows uses essentially a number like an md5 hash in terms of repeats) applications may just assume it doesn't happen even if it is technically allowed to do so.  A backup of file sync program might assume that a file with specific FileID is always the same file, if FileID 12345 is c:\MyDocuments\ImportantDoc1.docx one day and then c:\MyDocuments\ImportantDoc2.docx another it may mistake document 2 for document 1, overriding important data or restore data to the wrong place.  If it is trying to create a whole drive backup it may assume it has already backed up c:\MyDocuments\ImportantDoc2.docx if it now has the same File ID as ImportantDoc1.docx by the time it reaches it (at which point DrivePool would have a different FileID for Document1).

Why might applications use FileIDs or file change notifiers? It may not seem intuitive why applications would use these but a few major reasons are: *) Performance, file change notifiers are a event/push based system so the application is told when something changes, the common alternative is a poll based system where an application must scan all the files looking for changes (and may try to rely on file timestamps or even hashing the entire file to determine this) this causes a good bit more overhead / slowdown.  *)  FileID's are nice because they already handle hardlink file de-duplication (Windows may have multiple copies of a file on a drive for various reasons, but if you backup based on FileID you backup that file once rather than multiple times.  FileIDs are also great for handling renames.  Lets say you are an application that syncs files and the user backs up c:\temp\mydir with 1000 files under it.  If they rename c:\temp\mydir to c:\temp\mydir2 an application use FileIDS can say, wait that folder is the same it was just renamed. OK rename that folder in our remote version too.  This is a very minimal operation on both ends.  With DrivePool however the FileID changes for the directory and all sub-files.  If the sync application uses this to determine changes it now uploads all these files to the system using a good bit more resources locally and remotely.  If the application also uses versioning this may be far more likely to cause a conflict with two or more clients syncing, as mass amounts of files are seemingly being changed.

Finally, even if an application is trying to monitor for FileIDs changing using the file change API, due to notification bugs above it may not get any notifications when child FileIDs change so it might assume it has not.

Real Examples
This started with massive onedrive failures.  I would find onedrive was re-uploading hundreds of gigabytes of images an videos multiple times a week.  These were not changing or moving.  I don't know if the issue is onedrive uses FileIDs to determine if a file is already uploaded, or if it is because when it scanned a directory it may have triggered a notification that all the files in that directory changed and based on that notification it reuploads.  After this I noticed files were becoming deleted both locally and in the cloud.  I don't know what caused this, it might have been because the old file it thought was deleted as the FileID was gone and while there was a new file (actually the same file) in its place there may have been some odd race condition.   It is also possible that it queued the file for upload, the FileID changed and when it went to open it to upload it found it was 'deleted' as the FileID no longer pointed to a file and queued the delete operation.   I also found that files that were uploaded into the cloud in one folder were sometimes downloading to an alternate folder locally.  I am guessing this is because the folder FileID changed.  It thought the 2023 folder was with ID XYZ but that now pointed to a different folder and so it put the file in the wrong place.  The final form of corruption was finding the data from one photo or video actually in a file with a completely different name.  This is almost guaranteed to be due to the FileID bugs.  This is highly destructive as backups make this far harder to correct.  With one files contents replaced with another you need to know when the good content existed and in what files were effected.  Depending on retention policies the file contents that replaced it may override the good backups before you notice.  I also had a BSOD with onedrive where it was trying to set attributes on a file and the CoveFS driver corrupted some memory.  It is possible this was a race condition as onedrive may have been doing hundreds of files very rapidly due to the bugs.  I have not captured a second BSOD due to it, but also stopped using onedrive on DrivePool due to the corruption.   Another example of this is data leakage.  Lets say you share your favorite article on kittens with a group of people.   Onedrive, believing that file has changed, goes to open it using the FileID however that file ID could essentially now correspond to any file on your computer now the contents of some sensitive file are put in the place of that kitten file, and everyone you shared it with can access it.

Visual Studio Failures
Visual studio is a code editor/compiler.  There are three distinct bugs that happen.  First, when compiling if you touched one file in a folder it seemed to recompile the entire folder, this due likely to the notification bug.  This is just a slow down, but an annoying one.  Second, Visual Studio has compiler generated code support.  This means the compiler will generate actual source code that lives next to your own source code.   Normally once compiled it doesn't regenerate and compile this source unless it must change but due to the notification bugs it regenerates this code constantly and if there is an error in other code it causes an error there causing several other invalid errors.  When debugging visual studio by default will only use symbols (debug location data) as the notifications from DrivePool happen on certain file accesses visual studio constantly thinks the source has changed since it was compiled and you will only be able to breakpoint inside source if you disable the exact symbol match default.  If you have multiple projects in a solution with one dependent on another it will often rebuild other project deps even when they haven't changed, for large solutions that can be crippling (perf issue).  Finally I often had intellisense errors showing up even though no errors during compiling, and worse intellisense would completely break at points.  All due to DrivePool.

Technical details / full background & disclaimer

I have sample code and logs to document these issues in greater detail if anyone wants to replicate it themselves.

It is important for me to state drivepool is closed source and I don't have the technical details of how it works.  I also don't have the technical details on how applications like onedrive or visual studio work.  So some of these things may be guesses as to why the applications fail/etc.

The facts stated are true (to the best of my knowledge) 

Shortly before my trial expired in October of last year I discovered some odd behavior.  I had a technical ticket filed within a week and within a month had traced down at least one of the bugs.  The issue can be seen https://stablebit.com/Admin/IssueAnalysis/28720 , it does show priority 2/important which I would assume is the second highest (probably critical or similar above).  It is great it has priority but as we are over 6 months since filed without updates I figured warning others about the potential corruption was important.  

The FileSystemWatcher API is implemented in windows using async overlapped IO the exact code can be seen: https://github.com/dotnet/runtime/blob/57bfe474518ab5b7cfe6bf7424a79ce3af9d6657/src/libraries/System.IO.FileSystem.Watcher/src/System/IO/FileSystemWatcher.Win32.cs#L32-L66

That corresponds to this kernel api:

Newer api calls use GetFileInformationByHandleEx to get the FileID but with older stats calls represented by nFileIndexHigh/nFileIndexLow.  

In terms of the FileID bug I wouldn't normally have even thought about it but the advanced config (https://wiki.covecube.com/StableBit_DrivePool_2.x_Advanced_Settings) mentions this under CoveFs_OpenByFileId  "When enabled, the pool will keep track of every file ID that it gives out in pageable memory (memory that is saved to disk and loaded as necessary).".   Keeping track of files in memory is certainly very different from Windows so I thought this may be the source of issue.  I also don't know if there are caps on the maximum number of files it will track as if it resets FileIDs in situations other than reboots that could be much worse. Turning this off will atleast break nfs servers as it mentions it right in the docs "required by the NFS server".

Finally, the FileID numbers given out by DrivePool are incremental and very low.  This means when they do reset you almost certainly will get collisions with former numbers.   What is not clear is if there is the chance of potential FileID corruption issues.  If when it is assigning these ids in a multi-threaded scenario with many different files at the same time could this system fail? I have seen no proof this happens, but when incremental ids are assigned like this for mass quantities of potential files it has a higher chance of occurring.

Microsoft mentions this about deleting the USN Journal: "Deleting the change journal impacts the File Replication Service (FRS) and the Indexing Service, because it requires these services to perform a complete (and time-consuming) scan of the volume. This in turn negatively impacts FRS SYSVOL replication and replication between DFS link alternates while the volume is being rescanned.".  Now DrivePool never has the USN journal supported so it isn't exactly the same thing, but it is clear that several core Windows services do use it for normal operations I do not know what backups they use when it is unavailable. 

Potential Fixes
There are advanced settings for drivepool https://wiki.covecube.com/StableBit_DrivePool_2.x_Advanced_Settings beware these changes may break other things.
CoveFs_OpenByFileId - Set to false, by default it is true.  This will disable the OpenByFileID API.  It is clear several applications use this API.  In addition, while DrivePool may disable that function with this setting it doesn't disable FileID's themselves.  Any application using FileIDs as static identifiers for files may still run into problems. 

I would avoid any file backup/synchronization tools and DrivePool drives (if possible).  These likely have the highest chance of lost files, misplaced files, file content being mixed up, and excess resource usage.   If not avoiding consider taking file hashes for the entire drivepool directory tree.  Do this again at a later point and make sure files that shouldn't have changed still have the same hash.

If you have files that rarely change after being created then hashing each file at some point after creation and alerting if that file disappears or hash changes would easily act as an early warning to a bug here being hit.

Link to comment
Share on other sites

11 answers to this question

Recommended Posts

  • 0

MitchC, first of all thankyou for posting this! My (early a.m.) thoughts:

  • (summarised) "DrivePool does not properly notify the Windows FileSystem Watcher API of changes to files and folders in a Pool."

If so, this is certainly a bug that needs fixing. Indicating "I changed a file" when what actually happened was "I read a file" could be bad or even crippling for any cohabiting software that needs to respond to changes (as per your example of Visual Studio), as could neglecting to say "this folder changed" when a file/folder inside it is changed.

  • (summarised) "DrivePool isn't keeping FileID identifiers persistent across reboots, moves or renames."

Huh. Confirmed, and as I understand it the latter two should be persistent @Christopher (Drashna)? However, attaining persistence across reboots might be tricky given a FileID is only intended to be unique within a volume while a DrivePool file can at any time exist across multiple volumes due to duplication and move between volumes due to balancing and drive replacement. Furthermore as Microsoft itself states "File IDs are not guaranteed to be unique over time, because file systems are free to reuse them". I.e. software should not be relying solely on these over time, especially not backup/sync software! If OneDrive is actually relying on it so much that files are disappearing or swapping content then that would seem to be an own-goal by Microsoft. Digging further, it also appears that FileID identifiers (at least for NTFS) are not actually guaranteed to be collision-free (it's just astronomically improbable in the new 64+64bit format as opposed to the old but apparently still in use 16+48bit format).

  • (quote) "the FileID numbers given out by DrivePool are incremental and very low.  This means when they do reset you almost certainly will get collisions with former numbers."

Ouch. That's a good point. Any suggestions for mitigation until a permanent solution can be found? Perhaps initialising DrivePool's FileID counter using the system clock instead of initialising it to zero, e.g. at 100ns increments (FILETIME) even only an hour's uptime could give us a collision gap of roughly thirty-six billion?

  • (quote) "I would avoid any file backup/synchronization tools and DrivePool drives (if possible)."

I disagree; rather, I would opine that any backup/synchronization tool that relies solely on FileID for comparisons should be discarded (if possible); a metric that's not reliable over time should ipso facto not be trusted by software that needs to be reliable over time.

Incidentally, on the subject of file hashing I recommend ensuring Manage Pool -> Performance -> Read striping is un-ticked as I've found intermittent hashing errors in a few (not all) third-party tools when this is enabled; I don't know why this happens (maybe low-level disk calls that aren't compatible with non-physical volumes?) but disabling read-striping removes the problem and I've found the performance hit is minor.

Link to comment
Share on other sites

  • 0

Furthermore as Microsoft itself states "File IDs are not guaranteed to be unique over time, because file systems are free to reuse them". 

So this is correct, as the documentation you linked to states.  One item I mentioned though, is the fact that even if it can  be re-used if in practice it isn't software may make the wrong assumption that it won't.  Not good on that software but it may be a practical exception that one might try to meet.  Further, that documentation also states:

"In the NTFS file system, a file keeps the same file ID until it is deleted. "

As DrivePool identifies itself as NTFS it is breaking that expectation.


Any suggestions for mitigation until a permanent solution can be found?

I am not sure how well things work if you just disable File IDs, maybe software will fallback to a more safe behavior (even if less performant).    In addition, I think the biggest issue is silent file corruption.  I think that can only happen due to File ID collisions (rather than just the FIle ID changing).   It is a 128 bit number, GUID's are 128 bits.  Just randomize the sucker the first time you assign a file ID (rather than using the incremental behavior currently).  Aside from it being more thread safe as you don't have a single locked increment counter it is highly unlikely you would hit a collision.  Could you run into a duplicate ? sure.  Likely? Probably not.   Maybe over many reboots (or whatever resets the ID's in drivepool beside that) but as long as whatever app that uses the FileID has detected it is gone before it is reused it eventually colliding would likely not have much effect.   Not perfect but probably an easier solution.  Granted apps like onedrive may still think all the files are deleted and re-upload them if the FileID's change (although that may be more likely due to the notification bug).


I disagree; rather, I would opine that any backup/synchronization tool that relies solely on FileID for comparisons should be discarded (if possible); 

Sure.  Except one doesn't always know how tools work.  I am only making a highly educated guess this is what OneDrive is using, but only made this after significant file corruption and research.  One would hope you don't need to have corruption before figuring out the tool you are using uses the FileID.    In addition, FileID may not be the primary item a backup/sync tool uses but something like USF may be a much more common first choice.  It may only fall back to other options when that is not available.

Is it possible the 5-6 apps I have found that run into issues are the only ones out there that uses these things? Sure.  I just would guess I am not that lucky so there are likely many more that use these features.


I did see either you (or someone else) who posted about the file hashing issue with the read striping.  It is a big shame, reporting data corruption (invalid hash values or rather returning the wrong read data which is what would lead to that) is another fairly massive problem.    Marking good data bad because of an inconsistent read can lead to someone thinking they lost data and trashing it, or restoring an older version that may cause newer data to be lost in an attempt to fix.  I would look into a more consistent read striping repro test but at the end of the day these other things stop me from being able to use drivepool for most things I would like to.

Link to comment
Share on other sites

  • 0
4 hours ago, Shane said:

If so, this is certainly a bug that needs fixing

Sorry, should also mention this is confirmed by StableBit and can be easily reproduced.   The attached powershell script is a basic example of the file monitoring api.  Run it by "monitor.ps1 my_folder"  where my folder is what you want to monitor.  Have a file say hello.txt inside.   Open that file in notepad.     It should instantly generate a monitoring file change event.  Further tab away from notepad and tab back to it, you will again get a changed event for that file.  Run the same thing on a true NTFS system and it will not do the same.

You can also reproduce the lack of notifications for other events by changing the IncludeSubdirectories variable in it and doing some of the tests I mention above.


Link to comment
Share on other sites

  • 0

It depends what the application uses the FileID for but it may assume the FileID should stay the same when a file moves, as it doesn't with DrivePool this might mean it reads or backs up, or syncs the entire file again if it is moved (perf issue).

Very well explained Mitch. I just discovered this issue as well while trying to work out why my installation of Freefilesync wasn't behaving as expected.

Drivepool indeed changes fileid every time a file is renamed or moved which is not correct NTFS behaviour.

The result is that if i move say 100GB of data on my drivepool from one folder to another (or rename a large group of files) when I run freefilesync for backup instead of mirroring the file moves or renames, it needs to delete and recopy every moved or renamed file. Over the network this can take hours instead of less than a second so the impact is substantial.

Link to comment
Share on other sites

  • 0

I'll post it here too.  

There is a fix in the latest betas involving memory corruptions of file IDs.  

However, ... the issue may also be the wrong API being used: 


... incorrectly using File IDs as persistent file identifiers, which they should not be. File IDs in Windows can change from time to time on some filesystems.

Source: https://learn.microsoft.com/en-us/windows/win32/api/fileapi/ns-fileapi-by_handle_file_information

The identifier that is stored in the nFileIndexHigh and nFileIndexLow members is called the file ID. Support for file IDs is file system-specific. File IDs are not guaranteed to be unique over time, because file systems are free to reuse them. In some cases, the file ID for a file can change over time.

If this is the case, then it is expected behavior.

The correct API to use to get a persistent file identifier is FSCTL_CREATE_OR_GET_OBJECT_ID or FSCTL_GET_OBJECT_ID: https://learn.microsoft.com/en-us/windows/win32/api/winioctl/ni-winioctl-fsctl_create_or_get_object_id

Object IDs are persistent and do not change over time.

We support both Object IDs and File IDs.


Link to comment
Share on other sites

  • 0

Thanks for the reply Chris.

Note: the beta does not fix the FileID change on rename or copy issue.

I have posted your comment on the Freefilesync forums and will see if Object-ID is an option for consideration there.

Meanwhile I'd still think that it would be better if file-id behaved more like regular ntfs volumes and stayed persistent.

From the same document you referenced....


In the NTFS file system, a file keeps the same file ID until it is deleted. You can replace one file with another file without changing the file ID by using the ReplaceFile function. However, the file ID of the replacement file, not the replaced file, is retained as the file ID of the resulting file.

It mentions that with the FAT file system it is not safe to assume file-id will not change over time, but with NTFS it appears the file-id is indeed persistent for the life of the file.

Link to comment
Share on other sites

  • 0




Zenju12 Dec 2023, 14:33

Let's see...
File object IDs are supported only on NTFS volumes

But for NTFS we have:
In the NTFS file system, a file keeps the same file ID until it is deleted

Object ID = useless
File ID = perfect as persistent file identifier (on NTFS).


Response from Freefilesync developer. 
I read through the Microsoft docs you posted earlier and others, and I agree with the Freefilesync developer. 
It appears the best way to track all files on a volume on NTFS is to use fileid which is expected to stay persistent. This requires no extra overhead or work as the Filesystem maintains FileID’s automatically. 
ObjectID requires extra overhead and is only really intended to track special files like shortcuts for link tracking etc.
Any software that is emulating an NTFS system should therefore provide FileID’s and guarantee they stay persistent with a file on that volume.
I am seeing the direct performance impact from this and agree with Mitch that there can be other adverse side affects potentially much worse than just performance issues if someone uses software that expects FileID’s to behave as per Microsoft’s documentation. 
Finally also note that ObjectID is not supported by the Refs filesystem, whereas FileID is.
ReFS doesn't support object IDs. ReFS uses 128-bit file IDs, so can't cleanly distinguish between file ID versus object ID when processing an open by ID. 


Link to comment
Share on other sites

  • 0

FWIW, digging through Microsoft's documentation, I found these two entries in the file system protocols specification:



In short, if a file system cannot provide a file ID that is both unique within a given volume and stable until deleted, then it must set the field to either zero (indicating the file system does not support file IDs) or maxint (indicating the file system cannot given a particular file a unique ID) as per the specification.

Link to comment
Share on other sites

  • 0

Great finds by @Shane one more fantastic one: 

Table of the 7 file systems normally considered all support File IDs however per: https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/ns-ntifs-_file_objectid_information

"File object IDs are supported only on NTFS volumes".

In terms of the beta from the vague description it seems there was another problem were opening a File even with the current correct File ID could lead to an invalid memory access error, which may be what caused my BSODs related to this.  It does not sound like they fixed any of the items mentioned here with File IDs or notifications.

Thanks Christopher for posting here, I would have certainly missed it.   This really has all sorts of implications including data leakage where a file someone is given access to is overwritten by the contents of another file they should not have access to when the application used FileIDs.

In terms of Christopher's first post I think the quoting you did got a bit screwed up including quotes and responses:

I believe your first point is apps are wrong to rely on File IDs Microsoft says they may change per the documentation at https://learn.microsoft.com/en-us/windows/win32/api/fileapi/ns-fileapi-by_handle_file_information.  As I mention above, this is correct it states that, it then goes on to state "In the NTFS file system, a file keeps the same file ID until it is deleted.".   DrivePool emulates NTFS, therefore this being true is not only likely an assumed fact by developers but a reasonable assumption given microsoft states exactly that.   If DrivePool was not identifying as NTFS it might be a different story ( but still NTFS is the de-facto in windows so developers may just assume it true across all, even if incorrect).

There are 3 file identifier methods commonly used I believe:
1) the GetFileInformationByHandle: nFileIndexLow/nFileIndexHigh
2) the newer GetFileInformationByHandleEx: with the FileIdInfo flag returning the FILE_ID_INFO struct
3) The object ID methods like what you mentioned via ZwQueryDirectoryFile/DeviceIoControl

We have discussed one (per above).
The second:
https://learn.microsoft.com/en-us/windows/win32/api/winbase/ns-winbase-file_id_info  which states "The file identifier and the volume serial number uniquely identify a file on a single computer" although in reality it actually uses the same info from #1 just composited together into a single FILE_ID_128 field.  This can be compueted from nFileIndexLow/nFileIndexHigh for normal NTFS systems.

Finally, object ID.  This is a different identifier the problem is neither File ID or Object ID are guaranteed to be supported by a file system.   In NTFS both are possible as windows guesses if the number is bigger than 64 bits its an object ID and not a file ID.  In ReFS object ID's do not exist and are not supported but it does support File IDs.   Fat32 also doesn't support Object IDs. 

The other issue with Object IDs? They are not really designed to be primary application APIs.  It is queryable via two primary methods I believe: ZwQueryDirectoryFile a literal kernel call and the DeviceIoControl you linked to.


DeviceIoControl overall is "Sends a control code directly to a specified device driver, causing the corresponding device to perform the corresponding operation."  A user level application generally should not need to be interacting directly with a device driver.

File ID's can be operated on with file handles,  Object IDs require you having the device handle and going that route.

In short:

*) Per Shane's great finds all file systems should make it unique and stable
*) Specifications for NTFS identifying file systems is that the File ID is stable, unique and does not change
*) Object IDs is not supported on multiple file systems (out of 7 major tested systems only NTFS fully supports them)
*) File IDs have been the de-facto standard for quite some time on Windows

This isn't a good solution to say "use device ids".  Lets assume Stablebit was correct, and File IDs for NTFS are not stable/unique even then most people are not the application developer and changing the application is not likely.  Microsoft has teams that work on sharepoint and onedrive, I don't think messaging them to say "StableBit requires you to change the application to use Object IDs" is going to gain much ground.  Still given above we can see for NTFS it is incorrect anyway to say it is not stable.

This bug causes excessive data transfer, corruption, data loss, and data leakage with an unknown number of applications.  This problem is heavily compounded for continuous monitoring applications due to the fact DrivePool incorrectly reports file changes to listeners when a file is only read-accessed.   A listener who then checks the File notified about and sees the ID has changed then can open that by ID and do god knows what with the wrong information/data.   Final compounding problem is the fact DrivePool doesn't use remotely unique File IDs basically guaranteeing collision with previous File IDs.  They essentially start counting from 1 and issue from there.  Its a 64 bit field, give a random 64 bit number.  It won't solve excessive data transfer but it would have reduced the horrific impacts of this bug greatly.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Answer this question...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Create New...