FILE_ACTION_MODIFIED received if folder was added and if folder was removed + FILE_ACTION_MODIFIED not called at all if folder was renamed to different directory

Wallby 46 Reputation points
2022-05-05T17:58:02.697+00:00

According to https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/634043d7-7b39-47e9-9e26-bda64685e4c9 "[If] a file is renamed to a different directory the client will receive [FILE_ACTION_REMOVED] along with FILE_ACTION_MODIFIED." and "[If] a file is renamed to a different directory the client will receive [FILE_ACTION_MODIFIED] along with FILE_ACTION_REMOVED.".
However I called ReadDirectoryChangesW with FILE_NOTIFY_CHANGE_DIR_NAME and what I get is the following in the order written..

FILE_ACTION_ADDED + FILE_ACTION_MODIFIED for a folder that was added
FILE_ACTION_ADDED for the next folder that was added
FILE_ACTION_RENAMED_OLD_NAME then FILE_ACTION_RENAMED_NEW_NAME for a folder renamed but not to different directory
FILE_ACTION_REMOVED for a folder moved to different directory then FILE_ACTION_ADDED for that folder, but no FILE_ACTION_MODIFIED as is mentioned in the documentation
FILE_ACTION_REMOVED for a folder deleted
FILE_ACTION_REMOVED + FILE_ACTION_MODIFIED for the last folder deleted

Windows Open Specifications
Windows Open Specifications
Windows: A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.Open Specifications: Technical documents for protocols, computer languages, standards support, and data portability. The goal with Open Specifications is to help developers open new opportunities to interoperate with Windows, SQL, Office, and SharePoint.
41 questions
{count} votes

3 answers

Sort by: Most helpful
  1. Wallby 46 Reputation points
    2022-05-06T08:44:02.497+00:00

    Further testing.. if waiting till all messages arrived after each edit it seems that..
    .. FILE_ACTION_MODIFIED was sent twice (both w. a->FileName == the new directory) for the "folder [renaming] but not to different directory".
    .. FILE_ACTION_REMOVED and FILE_ACTION_ADDED consistently arrived simultanouesly in ordered pairs if a folder was "renamed to a different directory"
    .. if a folder was moved into a deeper folder.. FILE_ACTION_MODIFIED was sent twice for that deeper folder
    .. if a folder was moved intoa less deep folder.. FILE_ACTION_MODIFIED was never sent unlike as is claimed at https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/634043d7-7b39-47e9-9e26-bda64685e4c9


  2. Wallby 46 Reputation points
    2022-05-12T11:06:54.157+00:00

    More testing.. as I am using mingw where ReadDirectoryChangesExW isn't implemented I called CreateFileA twice and..
    .. supplied one HANDLE to ReadDirectoryChangesW w. only "file stuff"(i.e. dwNotifyFilter == FILE_NOTIFY_CHANGE_FILE_NAME | FILE_NOTIFY_CHANGE_LAST_WRITE)
    .. supplied the other HANDLE to ReadDirectoryChangesW w. only "folder stuff" (i.e. dwNotifyFilter == FILE_NOTIFY_CHANGE_DIR_NAME)

    Turns out that each of the two FILE_ACTION_MODIFIED were sent for the "file stuff HANDLE" though "FILE_NOTIFY_INFORMATION .FileName" was a foldername.

    I wouldn't expect FILE_NOTIFY_CHANGE_FILE_NAME to be the culprit as there is FILE_NOTIFY_CHANGE_DIR_NAME too thus it wouldn't make sense if "FILE_NAME" would "read change(s)" to folder(s) and "DIR_NAME" would "read change(s)" to file(s).
    I suspected that FILE_NOTIFY_CHANGE_LAST_WRITE for the folder as there is no "LAST_FILE_WRITE" nor "LAST_DIR_WRITE" and testing verified that this is indeed what causes both FILE_ACTION_MODIFIED actions.

    What's still odd..
    .. FILE_ACTION_MODIFIED was sent twice for one rename (for both actions .FileName was identical too)
    .. FILE_ACTION_MODIFIED was never send though "a file" was "renamed to a different directory" as is claimed here and thus detecting rename (different from add and then remove) to different directory is not possible.

    0 comments No comments

  3. Obaid Farooqi MSFT 591 Reputation points Microsoft Employee
    2022-06-04T20:56:49.913+00:00

    Hi @Wallby
    Unless we receive a network trace to see on what directory change notify was set, it is not possible to explain the behavior you are observing. In my experiments, I see that I receive one notification for one change notify. I only see multiple notifications when there are multiple change notification requests. Here are some frames to illustrate my point:
    208348-wireshark-snip.jpg

    There are three change notify requests in frames 88,90,94; two for parent directory and one for newdir
    I changed the name of a file inside newdir (frames 448, 449)
    I received three notifications, one for each change notify request in frames 451,452 and 453.
    Frame 451 corresponds to frame 94 (I received FILE_ACTION_RENAMED_OLD_NAME & FILE_ACTION_RENAMED_NEW_NAME)
    Frame 452 corresponds to frame 88 (I received FILE_ACTION_MODIFIED)
    Frame 453 corresponds to frame 90 (I received FILE_ACTION_MODIFIED)

    If you need the network trace, send me an email at dochelp at microsoft dot com.
    I have filed a bug against MS-FSCC in the light of the above observations.

    Please let me know if this does not answer your question.

    Regards,
    Obaid Farooqi -MSFT

    0 comments No comments