Thread: Zombie Files!

  1. #1
    Registered /usr
    Join Date
    Aug 2001
    Location
    Newport, South Wales, UK
    Posts
    1,273

    Unhappy Zombie Files!

    Hello,

    I seem to be running into a problem when attempting to re-create a file. This file contains information that changes on a regular basis, so I currently have it rigged so that if the file's creation date is older than 7 days it gets re-created.

    However, I have found that even after re-creation, the file's creation date remains over 7 days in the past. Originally I re-created the file solely by using the CREATE_ALWAYS flag in CreateFile. After discovering this bug I tried adding a DeleteFile call just before it, but no difference.

    Short of calling the new version of the file something else or using SetFileTime on it, is there a way that I can make sure dead files stay dead???

    Example:- (console mode)
    Code:
    #define WIN32_LEAN_AND_MEAN
    
    #include <windows.h>
    
    int main(void)
    {
    	char szCreated[32];
    	FILETIME ft, ftLocal;
    	HANDLE hFile;
    	SYSTEMTIME st;
    
    	if (!DeleteFile("test.abc"))
    		MessageBox(NULL, "File not created yet (run again a few minutes after for result)", NULL, MB_ICONEXCLAMATION);
    
    	hFile = CreateFile("test.abc", GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
    	if (hFile == INVALID_HANDLE_VALUE)
    		return -1;
    
    	GetFileTime(hFile, &ft, NULL, NULL);
    	CloseHandle(hFile);
    	FileTimeToLocalFileTime(&ft, &ftLocal);
    	FileTimeToSystemTime(&ftLocal, &st);
    	GetDateFormat(LOCALE_USER_DEFAULT, DATE_SHORTDATE, &st, NULL, szCreated, 32);
    	lstrcat(szCreated, " ");
    	GetTimeFormat(LOCALE_USER_DEFAULT, 0, &st, NULL, szCreated + lstrlen(szCreated), 32 - lstrlen(szCreated));
    	MessageBox(NULL, szCreated, NULL, MB_ICONINFORMATION);
    	return 0;
    }
    Run this once and make a note of the time given. Wait a few minutes and run it again. Although the file is deleted, when it is re-created it still has the same creation date!

  2. #2
    Registered User
    Join Date
    Mar 2005
    Location
    Mountaintop, Pa
    Posts
    1,058
    Run this once and make a note of the time given. Wait a few minutes and run it again. Although the file is deleted, when it is re-created it still has the same creation date!
    I ran your code and the timestamp of test.abc changes for me.

  3. #3
    Registered /usr
    Join Date
    Aug 2001
    Location
    Newport, South Wales, UK
    Posts
    1,273
    Oh.
    Well I've got three test systems: my actual desktop, a VM running under Virtual PC and a friend's computer and they all report the original timestamp of the file.

  4. #4
    Kernel hacker
    Join Date
    Jul 2007
    Location
    Farncombe, Surrey, England
    Posts
    15,677
    Yes, it does appear that this is the way it works on my (XP, Dual Core) machine as well.

    However, if you wait a sufficient time after deleting the file before creating the new one, it does have a new creation time. So my guess would be that NTFS somehow re-uses the same file-instance in the situation where you delete and recreate the same file - which sort of makes some sense, since it's likely that this is what programs do when the create a new document/file from an existing one - you wouldn't want Word to issue your file with a new creation date every time you update the document, despite the actual process is "delete old file, write new one". That is, however just a guess - it may be a bug for all that I know.

    --
    Mats
    Compilers can produce warnings - make the compiler programmers happy: Use them!
    Please don't PM me for help - and no, I don't do help over instant messengers.

  5. #5
    Reverse Engineer maxorator's Avatar
    Join Date
    Aug 2005
    Location
    Estonia
    Posts
    2,318
    You can always call SetFileTime() yourself though.

  6. #6
    Kernel hacker
    Join Date
    Jul 2007
    Location
    Farncombe, Surrey, England
    Posts
    15,677
    Quote Originally Posted by maxorator View Post
    You can always call SetFileTime() yourself though.
    Sure. I'm not entirely sure that is what the original post is concerning tho'.

    --
    Mats
    Compilers can produce warnings - make the compiler programmers happy: Use them!
    Please don't PM me for help - and no, I don't do help over instant messengers.

  7. #7
    Registered User Codeplug's Avatar
    Join Date
    Mar 2003
    Posts
    4,981
    Quote Originally Posted by MSDN for CreateFile
    Files

    If you rename or delete a file and then restore it shortly afterward, the system searches the cache for file information to restore. Cached information includes its short/long name pair and creation time.
    You could use TRUNCATE_EXISTING.

    gg

  8. #8
    Registered User
    Join Date
    Mar 2005
    Location
    Mountaintop, Pa
    Posts
    1,058
    You may want to enable change journaling on the NTFS volume in question if you are determined to debug this issue. Once enabled, run your app to generate the problem and then dump the journal to identify the source of the problem. The journal records all changes made to the file system and more.

    The MSDN docs are extremely sparse when it comes to change journaling. So, here is a starting point:

    Activate the Change Journal using DeviceIoControl with FSCTL_CREATE_USN_ JOURNAL code.

    Code:
    // Query the journal information
    USN_JOURNAL_DATA ujd;
          DWORD cb;
           DeviceIoControl(hCJ, FSCTL_QUERY_USN_JOURNAL, NULL, 0, 
             &ujd, sizeof(ujd), &cb, NULL);
    
    // Loop this read to dump the journal
     DeviceIoControl(hCJ, FSCTL_READ_USN_JOURNAL, &rujd, sizeof(rujd), 
                pbCJData, HeapSize(GetProcessHeap(), 0, pbCJData), &cb, NULL);

  9. #9
    Registered /usr
    Join Date
    Aug 2001
    Location
    Newport, South Wales, UK
    Posts
    1,273
    Realistically there is not much that i can do about it. As Codeplug and the others have said, this is another of those funny things that is "by design". The disk cache is my enemy here, so unless I force people to turn it off in the Performance settings of their systems then there is no way to simply make it do what it says it should ("create always" should mean just that, create != truncate).

    I guess I'll just call SetFileTime every time I want to re-create a file. Thanks guys.

  10. #10
    Kernel hacker
    Join Date
    Jul 2007
    Location
    Farncombe, Surrey, England
    Posts
    15,677
    Do you HAVE to use file-created time? Last update will be changed EVERY time.

    And it is not your disk-cache that the user can turn on and off - it is a list of "recently used files" inside the file-system - I'm pretty sure you can't turn it off.

    --
    Mats
    Compilers can produce warnings - make the compiler programmers happy: Use them!
    Please don't PM me for help - and no, I don't do help over instant messengers.

  11. #11
    Algorithm Dissector iMalc's Avatar
    Join Date
    Dec 2005
    Location
    New Zealand
    Posts
    6,318
    Quote Originally Posted by SMurf View Post
    I guess I'll just call SetFileTime every time I want to re-create a file. Thanks guys.
    Just thought I should let you know that we ran into the above problem quite a few years ago, and also employed that same solution. It's a quirk with Windows OSes.
    My homepage
    Advice: Take only as directed - If symptoms persist, please see your debugger

    Linus Torvalds: "But it clearly is the only right way. The fact that everybody else does it some other way only means that they are wrong"

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. Ressources files
    By mikahell in forum Windows Programming
    Replies: 4
    Last Post: 06-19-2006, 06:50 AM
  2. add source files to embedded VC 4.0
    By George2 in forum C++ Programming
    Replies: 4
    Last Post: 06-13-2006, 03:28 AM
  3. *.cpp and *.h files understanding
    By ElastoManiac in forum C++ Programming
    Replies: 4
    Last Post: 06-11-2006, 04:45 AM
  4. Linking header files, Source files and main program(Accel. C++)
    By Daniel Primed in forum C++ Programming
    Replies: 3
    Last Post: 01-17-2006, 11:46 AM
  5. Multiple Cpp Files
    By w4ck0z in forum C++ Programming
    Replies: 5
    Last Post: 11-14-2005, 02:41 PM