Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > alt.comp.os.windows-10 > #186711

Re: It is stunning when you see how badly Windows operates: indexing

From Alan <nuh-uh@nope.com>
Newsgroups alt.comp.os.windows-10, comp.sys.mac.advocacy, alt.comp.os.windows-11
Subject Re: It is stunning when you see how badly Windows operates: indexing
Date 2025-08-12 08:54 -0700
Organization A noiseless patient Spider
Message-ID <107fo2v$3bn97$3@dont-email.me> (permalink)
References (6 earlier) <107bq4h$2ah49$1@dont-email.me> <107c1lq$27jk$1@nnrp.usenet.blueworldhosting.com> <107c285$2c32t$1@dont-email.me> <107dckr$2nolj$7@dont-email.me> <107eim1$32gtq$1@dont-email.me>

Cross-posted to 3 groups.

Show all headers | View raw

On 2025-08-11 22:15, Paul wrote:
> On Mon, 8/11/2025 2:26 PM, Alan wrote:
>> On 2025-08-10 23:23, Hank Rogers wrote:
>>> Marion <marion@facts.com> wrote:
>>>> On Mon, 11 Aug 2025 00:04:32 -0400, Paul wrote :
>>>>
>>>>
>>>>> And to help you, I have explained the implementation.
>>>>
>>>> Paul,
>>>>
>>>> You're not normally on the Apple newsgroups, but I'm sure you're aware of
>>>> the Apple religious zealotry, which will stop at nothing to promote/defend
>>>> Apple to the death.
>>>>
>>>> In case you're unaware, Alan Baker is a classic Apple troll whom most of us
>>>> have plonked years ago, as is David B. (although he's making a Snit-like
>>>> resurgence recently) as is WolfFan & Hank Rogers - all of whom are similar.
>>>>
>>>> They're all Apple religious nutcases who almost hate that Windows exists.
>>>>
>>>> There's nothing wrong, per se, with them adoring their macs, but what's
>>>> common with all of them is none of them know anything about Windows.
>>>>
>>>> The only thing they know is what Apple marketing advertises.
>>>> They make *all* their decisions based purely on Apple advertising, in fact.
>>>>
>>>> They're herd animals to the core - where they live for affirmation of their
>>>> choices which themselves were dictated by Apple - and not by critical
>>>> thought processes.
>>>>
>>>> Anyway, you're welcome to strive to edify them but I think it's impossible.
>>>>
>>>
>>> Wrong.  I don’t have a Mac and don’t want one.
>>>
>>
>> And also wrong in that the "edification" Paul was attempting to provide was plainly incorrect.
>>
>> :-)
> 
> Here is an experiment carried out on an NTFS partition.
> The NTFS partition is created just for this exercise -- as
> a data partition, it is a bit "quieter". There are no intervening
> events polluting sequences here.
> 
> *******
> 
> I started with "how do you do the equivalent of touch() in Windows".
> Some AI at Google, provided this.
> 
> type nul > E:\empty.txt
> 
> The first thing I noticed, is right after this when I attempted to
> read the usn journal, it did not respond. First then, I had to create
> a journal.
> 
> fsutil usn createjournal [m=1000 a=100] e:          # The size arguments are not required, and I used defaults
> 
> fsutil usn readjournal E:  > S:\journal-output.txt  # This dumps the journal so far.
> 
> This is the event which shows an example of a zero length file being created.
> 
> Usn               : 0
> File name         : empty.txt
> File name length  : 18
> Reason            : 0x00000004: Data truncation
> Time stamp        : Tue, 8/12/2025 0:11:24
> File attributes   : 0x00000020: Archive
> File ID           : 00000000000000000001000000000026
> Parent file ID    : 00000000000000000005000000000005
> Source info       : 0x00000000: *NONE*
> Security ID       : 0
> Major version     : 3
> Minor version     : 0
> Record length     : 96
> 
> *******
> 
> Now that the journal is running, the first experiment is to
> copy a file from the root folder, down to an arbitrary folder lower down.
> There are six journal entries, and this is the last entry. The event
> changes seem to be ORed together in the status word. Basic info change,
> might be the final size of the copied file. The nfi.exe entry shows
> how the file information is stored in the Master File Table.
> 
> Copy background.bmp to A\B\C\D\E
> 
> Usn               : 5584
> File name         : background.bmp
> File name length  : 28
> Reason            : 0x80008903: Data overwrite | Data extend | File create | Security change | Basic info change | Close
> Time stamp        : Tue, 8/12/2025 0:23:01
> File attributes   : 0x00000020: Archive
> File ID           : 00000000000000000001000000000033
> Parent file ID    : 0000000000000000000100000000002f
> Source info       : 0x00000000: *NONE*
> Security ID       : 0
> Major version     : 3
> Minor version     : 0
> Record length     : 104
> 
> (Insert NFI entry here)
> File 51                           File ID 0x33
> \A\B\C\D\E\background.bmp                                <=== this is my copied file
>      $STANDARD_INFORMATION (resident)
>      $FILE_NAME (resident)
>      $DATA (nonresident)
>          logical sectors 76568-84167 (0x12b18-0x148c7)
> 
> *******
> 
> This uses the mouse to move from the root folder, to five levels down,
> using two file explorer windows. As long as the balloon text next to the
> mouse cursor says (Move), it is being moved and not copied.
> 
> This is not an atomic event. It's two separate events. Status words
> do not using the ORing scheme.
> 
> Move background2.bmp to A\B\C\D\E
> 
> Usn               : 5672
> File name         : background2.bmp
> File name length  : 30
> Reason            : 0x00001000: Rename: old name
> Time stamp        : Tue, 8/12/2025 0:24:01
> File attributes   : 0x00000020: Archive
> File ID           : 00000000000000000001000000000031
> Parent file ID    : 00000000000000000005000000000005
> Source info       : 0x00000000: *NONE*
> Security ID       : 0
> Major version     : 3
> Minor version     : 0
> Record length     : 112
> 
> Usn               : 5768
> File name         : background2.bmp
> File name length  : 30
> Reason            : 0x00002000: Rename: new name
> Time stamp        : Tue, 8/12/2025 0:24:01
> File attributes   : 0x00000020: Archive
> File ID           : 00000000000000000001000000000031
> Parent file ID    : 0000000000000000000100000000002f
> Source info       : 0x00000000: *NONE*
> Security ID       : 0
> Major version     : 3
> Minor version     : 0
> Record length     : 112
> 
> Usn               : 5864
> File name         : background2.bmp
> File name length  : 30
> Reason            : 0x80002000: Rename: new name | Close
> Time stamp        : Tue, 8/12/2025 0:24:01
> File attributes   : 0x00000020: Archive
> File ID           : 00000000000000000001000000000031
> Parent file ID    : 0000000000000000000100000000002f
> Source info       : 0x00000000: *NONE*
> Security ID       : 0
> Major version     : 3
> Minor version     : 0
> Record length     : 112
> 
> (Insert NFI entry here) [Keeps using same Filenum entry]
> File 49                           File ID 0x31
> \A\B\C\D\E\background2.bmp                      <=== this is the path after the move
>      $STANDARD_INFORMATION (resident)
>      $FILE_NAME (resident)
>      $DATA (nonresident)
>          logical sectors 63128-70727 (0xf698-0x11447)
> 
> *******
> 
> For the third and final experiment, we can check to see if a hardlink
> was being used to implement a move. It is not. It's a separate event.
> To use this to make a move() needs two journal entries, the first entry
> to make-your-own move() is making the hardlink, the second operation
> would be removing the original $FILE_NAME entry (which would drop the
> nfi.exe entry below to having only one $FILE_NAME. Doing the move()
> this way is not atomic or compact either, because it would take
> two events to do it this way as well.
> 
> mklink background5.bmp to A\B\C\D\E
>     mklink /h  E:\A\B\C\D\E\background5.bmp  E:\background5.bmp
> 
> Usn               : 5960
> File name         : background5.bmp
> File name length  : 30
> Reason            : 0x80010000: Hard link change | Close
> Time stamp        : Tue, 8/12/2025 0:29:24
> File attributes   : 0x00000020: Archive
> File ID           : 00000000000000000001000000000032
> Parent file ID    : 0000000000000000000100000000002f
> Source info       : 0x00000000: *NONE*
> Security ID       : 0
> Major version     : 3
> Minor version     : 0
> Record length     : 112
> 
> (Insert NFI entry here) [Adds a second $FILE_NAME to the entry, describes both hardlinked items]
> File 50                           File ID 0x32
> \background5.bmp
>      $STANDARD_INFORMATION (resident)
>      $FILE_NAME (resident)              \___ To show how one set of clusters can have two names
>      $FILE_NAME (resident)              /
>      $DATA (nonresident)
>          logical sectors 70728-76567 (0x11448-0x12b17)
> 
> Summary: It takes calculus to correlate the individual events
>           in the trace with one another. Do I personally know what
>           intervening events could be stuffed between events in this
>           trace ? I do not know.
In summary:

You claimed that moving a file generated a deletefile entry and a 
createfile entry in the USN journal...

...and you've just shown that to be bullshit.

Back to alt.comp.os.windows-10 | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-08-09 16:30 -0700
  Re: It is stunning when you see how badly Windows operates: indexing Hank Rogers <Hank@nospam.invalid> - 2025-08-09 18:55 -0500
    Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-08-09 17:08 -0700
      Re: It is stunning when you see how badly Windows operates: indexing Windows11 Proud User <Windows@invalid.invalid> - 2025-08-10 00:51 +0000
      Re: It is stunning when you see how badly Windows operates: indexing Hank Rogers <invalid@nospam.com> - 2025-08-10 03:22 +0000
        Re: It is stunning when you see how badly Windows operates: indexing Paul <nospam@needed.invalid> - 2025-08-09 23:52 -0400
          Re: It is stunning when you see how badly Windows operates: indexing "David B." <BD@hotmail.co.uk> - 2025-08-10 09:54 +0100
  Re: It is stunning when you see how badly Windows operates: indexing Paul <nospam@needed.invalid> - 2025-08-09 23:28 -0400
  Re: It is stunning when you see how badly Windows operates: indexing "Mr. Man-wai Chang" <toylet.toylet@gmail.com> - 2025-08-10 12:34 +0800
    Re: It is stunning when you see how badly Windows operates: indexing Paul <nospam@needed.invalid> - 2025-08-10 11:25 -0400
      Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-08-10 12:37 -0700
        Re: It is stunning when you see how badly Windows operates: indexing Paul <nospam@needed.invalid> - 2025-08-10 19:46 -0400
          Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-08-10 17:00 -0700
            Re: It is stunning when you see how badly Windows operates: indexing Paul <nospam@needed.invalid> - 2025-08-11 00:04 -0400
              Re: It is stunning when you see how badly Windows operates: indexing Marion <marion@facts.com> - 2025-08-11 06:13 +0000
                Re: It is stunning when you see how badly Windows operates: indexing Hank Rogers <invalid@nospam.com> - 2025-08-11 06:23 +0000
                Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-08-11 11:26 -0700
                Re: It is stunning when you see how badly Windows operates: indexing Paul <nospam@needed.invalid> - 2025-08-12 01:15 -0400
                Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-08-12 08:54 -0700
                Re: It is stunning when you see how badly Windows operates: indexing Paul <nospam@needed.invalid> - 2025-08-12 13:41 -0400
                Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-08-12 10:54 -0700
                Re: It is stunning when you see how badly Windows operates: indexing Tom Elam <thomas.e.elam@gmail.com> - 2025-10-01 14:56 -0400
                Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-10-01 14:08 -0700
              Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-08-11 10:57 -0700
                Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-08-12 08:52 -0700
      Re: It is stunning when you see how badly Windows operates: indexing "Mr. Man-wai Chang" <toylet.toylet@gmail.com> - 2025-08-11 20:22 +0800
        Re: It is stunning when you see how badly Windows operates: indexing Marion <marion@facts.com> - 2025-08-11 19:16 +0000
          Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-08-11 17:03 -0700
          Re: It is stunning when you see how badly Windows operates: indexing "Mr. Man-wai Chang" <toylet.toylet@gmail.com> - 2025-08-12 12:36 +0800
    Re: It is stunning when you see how badly Windows operates: indexing Brian Gregory <void-invalid-dead-dontuse@email.invalid> - 2025-10-06 15:49 +0100
  Re: It is stunning when you see how badly Windows operates: indexing WolfFan <akwolffan@zoho.com> - 2025-08-10 18:33 -0400
    Re: It is stunning when you see how badly Windows operates: indexing Paul <nospam@needed.invalid> - 2025-08-11 02:12 -0400
      Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-08-11 11:25 -0700
        Re: It is stunning when you see how badly Windows operates: indexing Paul <nospam@needed.invalid> - 2025-08-11 18:02 -0400
          Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-08-11 17:01 -0700
            Re: It is stunning when you see how badly Windows operates: indexing Paul <nospam@needed.invalid> - 2025-08-12 01:24 -0400
              Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-08-12 08:49 -0700
              Re: It is stunning when you see how badly Windows operates: indexing Marion <marion@facts.com> - 2025-08-12 17:10 +0000
          Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-08-12 08:55 -0700
  Re: It is stunning when you see how badly Windows operates: indexing Tom Elam <thomas.e.elam@gmail.com> - 2025-08-17 16:03 -0400
    Re: It is stunning when you see how badly Windows operates: indexing Paul <nospam@needed.invalid> - 2025-08-17 18:15 -0400
  Re: It is stunning when you see how badly Windows operates: indexing "Carlos E.R." <robin_listas@es.invalid> - 2025-10-01 22:19 +0200
    Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-10-01 14:18 -0700
    Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-10-05 15:01 -0700
      Re: It is stunning when you see how badly Windows operates: indexing Lars Poulsen <lars@cleo.beagle-ears.com> - 2025-10-06 02:46 +0000
        Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-10-05 21:16 -0700
          Re: It is stunning when you see how badly Windows operates: indexing Daniel70 <daniel47@nomail.afraid.org> - 2025-10-06 19:23 +1100
            Re: It is stunning when you see how badly Windows operates: indexing MikeS <MikeS@fred.com> - 2025-10-06 09:56 +0100
              Re: It is stunning when you see how badly Windows operates: indexing Daniel70 <daniel47@nomail.afraid.org> - 2025-10-06 20:54 +1100
                Re: It is stunning when you see how badly Windows operates: indexing Brian Gregory <void-invalid-dead-dontuse@email.invalid> - 2025-10-06 15:59 +0100
                Re: It is stunning when you see how badly Windows operates: indexing "Carlos E.R." <robin_listas@es.invalid> - 2025-10-06 22:35 +0200
                Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-10-06 13:53 -0700
                Re: It is stunning when you see how badly Windows operates: indexing Daniel70 <daniel47@nomail.afraid.org> - 2025-10-08 20:12 +1100
                Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-10-08 08:18 -0700
                Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-10-06 08:59 -0700
                Re: It is stunning when you see how badly Windows operates: indexing Daniel70 <daniel47@nomail.afraid.org> - 2025-10-08 20:18 +1100
                Re: It is stunning when you see how badly Windows operates: indexing "J. P. Gilliver" <G6JPG@255soft.uk> - 2025-10-08 11:16 +0100
                Re: It is stunning when you see how badly Windows operates: indexing MikeS <MikeS@fred.com> - 2025-10-06 17:28 +0100
                Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-10-06 09:33 -0700
                Re: It is stunning when you see how badly Windows operates: indexing Daniel70 <daniel47@nomail.afraid.org> - 2025-10-08 20:23 +1100
                Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-10-08 08:20 -0700
            Re: It is stunning when you see how badly Windows operates: indexing "Carlos E.R." <robin_listas@es.invalid> - 2025-10-06 14:22 +0200
              Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-10-06 09:00 -0700
              Re: It is stunning when you see how badly Windows operates: indexing Daniel70 <daniel47@nomail.afraid.org> - 2025-10-08 20:30 +1100
                Re: It is stunning when you see how badly Windows operates: indexing "Carlos E.R." <robin_listas@es.invalid> - 2025-10-08 11:48 +0200
                Re: It is stunning when you see how badly Windows operates: indexing "J. P. Gilliver" <G6JPG@255soft.uk> - 2025-10-08 11:25 +0100
                Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-10-08 08:22 -0700
                Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-10-08 08:21 -0700
                Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-10-08 08:20 -0700
            Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-10-06 08:58 -0700
              Re: It is stunning when you see how badly Windows operates: indexing "Carlos E.R." <robin_listas@es.invalid> - 2025-10-06 22:44 +0200
                Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-10-06 13:56 -0700
                Re: It is stunning when you see how badly Windows operates: indexing "Carlos E.R." <robin_listas@es.invalid> - 2025-10-06 23:22 +0200
                Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-10-06 16:51 -0700
              Re: It is stunning when you see how badly Windows operates: indexing Daniel70 <daniel47@nomail.afraid.org> - 2025-10-08 20:35 +1100
                Re: It is stunning when you see how badly Windows operates: indexing "J. P. Gilliver" <G6JPG@255soft.uk> - 2025-10-08 11:38 +0100
                Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-10-08 08:23 -0700
          Re: It is stunning when you see how badly Windows operates: indexing Paul <nospam@needed.invalid> - 2025-10-06 04:52 -0400
          Re: It is stunning when you see how badly Windows operates: indexing "Carlos E.R." <robin_listas@es.invalid> - 2025-10-06 14:17 +0200
            Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-10-06 09:12 -0700
              Re: It is stunning when you see how badly Windows operates: indexing "Carlos E.R." <robin_listas@es.invalid> - 2025-10-06 22:47 +0200
                Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-10-06 14:12 -0700
                Re: It is stunning when you see how badly Windows operates: indexing "Carlos E.R." <robin_listas@es.invalid> - 2025-10-06 23:25 +0200
                Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-10-06 16:55 -0700
                Re: It is stunning when you see how badly Windows operates: indexing Daniel70 <daniel47@nomail.afraid.org> - 2025-10-08 21:21 +1100
                Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-10-08 08:24 -0700
  Re: It is stunning when you see how badly Windows operates: indexing Brian Gregory <void-invalid-dead-dontuse@email.invalid> - 2025-10-06 15:45 +0100
    Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-10-06 09:13 -0700
      Re: It is stunning when you see how badly Windows operates: indexing Brian Gregory <void-invalid-dead-dontuse@email.invalid> - 2025-10-06 17:48 +0100
        Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-10-06 10:08 -0700
    Re: It is stunning when you see how badly Windows operates: indexing Paul <nospam@needed.invalid> - 2025-10-06 19:51 -0400
      Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-10-06 17:27 -0700
        Re: It is stunning when you see how badly Windows operates: indexing Paul <nospam@needed.invalid> - 2025-10-06 21:47 -0400
          Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-10-06 22:13 -0700
          Re: It is stunning when you see how badly Windows operates: indexing Daniel70 <daniel47@nomail.afraid.org> - 2025-10-08 22:01 +1100
            Re: It is stunning when you see how badly Windows operates: indexing Paul <nospam@needed.invalid> - 2025-10-08 10:45 -0400
              Re: It is stunning when you see how badly Windows operates: indexing Alan <nuh-uh@nope.com> - 2025-10-08 08:25 -0700

csiph-web