Files created through context menu have empty alternate stream about filemeta

[Dijji]

[Dijji@07/12/2015]
This is the Control Stream, described here in MSDN As it says, this is required for a file containing one or more property sets stored using the alternate stream binding.

The reason that you see it when using right click and new in Explorer to create a file is that whenever Explorer creates a file of a type with a property handler registered, it tries to write System.Author and System.Document.DateCreated property values. For a type registered with the File Meta property handler, this creates a SummaryInformation alternate stream, and so a Control Stream is also required.

There is some evidence that things don’t work properly if the Control Stream is tampered with, for example one blogger discovered that if the Control Stream has any contents, then the summary information is not displayed in Explorer.

So I think that the presence of this stream is mandated for the use of alternate streams to store properties, and cannot be avoided. The good news is that it should appear if and only if an alternate stream containing properties is present, as it is in the ‘new’ case that you describe, and so AltStreamOverlay should not be reporting files as having alternate streams when they have no meaningful information stored using them.

if I`m wrong, please feel free to teach me the error of my ways!

Dijji

[Dijji]

[ZippedSource@07/12/2015]
Thank you for fastest clarification!

May be you can create additional item in context menu to clear all ADS (in actual versions of FileMeta 'Delete' command removes only assigned metadata properties)?

AltStreamOverlay (there is bug in order of enumeration and content preview of streams at file/folder property page) handle empty streams and draw overlay even in this case.

[Dijji]

[Dijji@07/12/2015]
What the code does today is to enumerate all of the property sets and delete them, using the Windows API for manipulating properties stored by NTFS in alternate streams. However, while this process removes all of the data carrying alternate streams, it leaves the{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} stream behind. To remove this stream as well, I would need to resort to manipulating the file directly, and deleting that stream by name. I will consider adding this in the next iteration. It would be a worrying change however, since the NTFS implementation of the property store is what creates the Control Stream, and could equally well delete it when the last property store was deleted. One wonders if NTFS has some reason for keeping it around.

In the meantime, if you feel comfortable with removing the Control Stream, the easiest way for you to do so is to use the following Powershell command:

remove-item -path mydir\foo.txt -stream "{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}"

I would recommend using the context menu to remove all property data first, however, as otherwise the file system will certainly be in a state that it should not have reached.

Dijji

[Dijji]

[Dijji@26/08/2016]
Having thought about this, I will not proceed with it, as it runs against the grain of NTFS. It feels as though it would introduce a little too much risk.

Dijji

[Dijji]

[UnknownUser@26/08/2016]

[Dijji]

Issue closed by Dijji with comment
Decided not to proceed

Reason closed
Fixed