File “Date modified” property are not updating while modifying a file without closing it.

These days, we are monitoring this issue:
when one was developing a utility that monitors log files as they are updated.

On 2003, opening the log file folder in explorer, you can see the timestamp and files size change before your eyes each time the log is updated.

On 2008, “Last Modified” field on log files is not updated unless another program attempts to open the file or the utility is stopped, even if F5 is pressed to refresh the view.

Explorer gets is information from NTFS, by using a cmd prompt and “dir” we found that the NTFS metadata for the files is not updated until the handle to a file is closed.

Refreshing the information of a FOLDER is just going to go to the (memory resident) metadata cached by NTFS, but querying the file explicitly will force disk I/O to get the properties – this was a design change introduced in Vista to reduce unnecessary disk I/O to improve performance

There are some exceptions to this rule:
– in some, but not all, cases a simple “dir filename” is enough to refresh the metadata
– “special” folders may be treated differently, such as user profiles where we do not expect a large number of files and want to be able to rely on the file data presented
– kernel filter drivers may change the behaviour as by design they “add, remove or
change functionality of other drivers”

As the workaround is for any process to open and close a handle to the log files, a tool was written to do exactly that, plus get the file information, using the following APIs:
CreateFile
GetFileInformationByHandle
CloseHandle

Reference:
http://social.technet.microsoft.com/Forums/en-US/winservergen/Thread/2B8BACA2-9C1B-4D80-80ED-87A3D6B1336F

Environment Variables

https://msdn.microsoft.com/en-us/library/windows/desktop/ms682653%28v=vs.85%29.aspx

Every process has an environment block that contains a set of environment variables and their values. There are two types of environment variables: user environment variables (set for each user) and system environment variables (set for everyone).

By default, a child process inherits the environment variables of its parent process. Programs started by the command processor inherit the command processor’s environment variables. To specify a different environment for a child process, create a new environment block and pass a pointer to it as a parameter to the CreateProcess function.

Continue reading “Environment Variables”

The ‘Sysnative’ folder in 64-bit Windows explained

In this article we explained that in a 64-bit Windows the System32 folder is intended for 64-bit binary files (DLL files etc.) and the SysWOW64 folder is intended for 32-bit binary files. In the article we also explained that if a 32-bit application includes the “\System32” folder name in a folder path, the system automatically makes a redirection to the SysWOW64 folder. This is to prevent compatibility problems when applications are compiled to 64-bit executables.

Continue reading “The ‘Sysnative’ folder in 64-bit Windows explained”