[ntfs-3g-devel] Multiple unnamed data streams?

[Eric B. <ebi...@gm...>]

Hi,

I had a report of a file's data disappearing when an NTFS volume was archived
using wimlib, which uses libntfs-3g to read from NTFS volumes.  What seems to
have happened is that libntfs-3g reported two unnamed data streams for a file:
one nonempty and one empty, and wimlib happened to store the empty one
(arbitrarily).

Is it an expected or valid case for a file to have more than one unnamed data
stream like this?  When and how might this happen?

If it's relevant: in wimlib I am basically doing something like this:

	ntfs_attr_search_ctx *actx = ntfs_attr_get_search_ctx(ni, NULL);

	while (!ntfs_attr_lookup(AT_DATA, NULL, 0, CASE_SENSITIVE, 0, NULL, 0, actx))
	{
		ATTR_RECORD *record = actx->attr;
		u32 name_nchars = record->name_length;
		ntfschar *name = (ntfschar *) ((u8 *)record + le16_to_cpu(record->name_offset));

		if (name_chars == 0) {
			/* unnamed stream... */
		} else {
			/* named stream... */
		}
	}


I know that for the problem to have been apparent, ntfs_attr_lookup() must have
provided the nonempty version of the stream first and the empty version second.
This may explain why this problem isn't encountered more frequently, since
perhaps the first matching stream is used ordinarily and the empty duplicate
streams always appear second.

Eric