microsoft.public.win32.programmer.kernel

Hi,

I'm writing some code that uses FSCTL_GET_NTFS_FILE_RECORD to read the
FileName attribute from MFT file records.

I've noticed that, for most records, the DataSize, AllocatedSize and
LastWriteTime are accurate when compared to the values in win explorer file
properties. However, for some more recent files/records the size values are
always 0 and the timestamp is incorrect.

Has anyone experienced this issue? I'm hoping to gain an understanding of
how/when NTFS updates the record with the correct values.

Thanks.

--
Matt