offline attribute ingnored by explorer

Hi,

This may be an old thing, but i could not find any answer so far. We are developing an archiving (HSM) solution for our own use that uses a minifilter to trigger a restore operation.
Everything works fine, apart from one thing: even if the offline attribute is set on a jpeg or doc file stub, windows explorer generates createfile with GENERAL_READ, and readfile as well, even on a simple directory refresh with ctrl-r. In turn these operations cause the file to be restored from the archive. The minifilter will run on a file server so filtering by process name is not an option.
My understanding was that the offline attribute was meant to signal that the file should not be opened for data access only on explicit request.
I would appreciate any ideas, I am just unable to believe that the same company that introduced a file attribute that should be respected , violates it on the first place.

Thank you,
Gabor

>I am just unable to believe that the same company that introduced a file
attribute that should be respected, violates it on the first place.

I have no technical advice for you. Career-wise, you are not going to
enjoy this assignment.

On Thu, Feb 22, 2018 at 10:57 AM, xxxxx@gmail.com <
xxxxx@lists.osr.com> wrote:

Hi,

This may be an old thing, but i could not find any answer so far. We are
developing an archiving (HSM) solution for our own use that uses a
minifilter to trigger a restore operation.
Everything works fine, apart from one thing: even if the offline
attribute is set on a jpeg or doc file stub, windows explorer generates
createfile with GENERAL_READ, and readfile as well, even on a simple
directory refresh with ctrl-r. In turn these operations cause the file to
be restored from the archive. The minifilter will run on a file server so
filtering by process name is not an option.
My understanding was that the offline attribute was meant to signal that
the file should not be opened for data access only on explicit request.
I would appreciate any ideas, I am just unable to believe that the same
company that introduced a file attribute that should be respected ,
violates it on the first place.

Thank you,
Gabor


NTFSD is sponsored by OSR

MONTHLY seminars on crash dump analysis, WDF, Windows internals and
software drivers!
Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer&gt;
></http:>

If memory serves me correctly, Windows Explorer on XP honored the offline attribute. I think it was Windows Explorer on Windows 7 or maybe Windows 8 that reads files with the offline attribute to create icons of the file. You will find antivirus software also reading the file and bring it back.

You will also find a problem with Windows Explorer no longer displaying the offline icon.

I don’t know of any good solution to any of these problems.

I haven’t tried to fight with Explorer and this bit for a long time. But, the shell is weird and I don’t doubt that something is ignoring your bit. A few things:

  1. How are you setting the bit? Are you actually setting it on the file or are you adding it to the query attributes calls?

  2. Which version of Windows is this?

  3. What is the call stack of the thread doing the open?

  4. There were a ton of changes to the shell in RS3 to better support situations like this (really for the OneDrive Files on Demand feature). See the FILE_ATTRIBUTE_RECALL_ON_OPEN and FILE_ATTRIBUTE_RECALL_ON_DATA_ACCESS bits. This doesn’t necessarily help you with the problem on older systems, but it should be better on newer systems.

-scott
OSR
@OSRDrivers

Thank you for all the insight. It feels good not to be alone in the universe.
Looks like explorer DOES respect (more or less) the offline flag if the drive is a network drive, but does not if it is a local drive. All my tests were on local drive before. This is great news as I can filter local access in different ways, and remote folder view does not trigger data access apart from some picture image reading that I can live with.

Gabor