Comments on: Essential and Derived Properties https://www.dumpanalysis.org/blog/index.php/2009/10/15/essential-and-derived-properties/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Tue, 05 May 2026 21:57:47 +0000 http://wordpress.org/?v=2.3.3 By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2009/10/15/essential-and-derived-properties/#comment-99409 Dmitry Vostokov Fri, 16 Oct 2009 15:43:48 +0000 https://www.dumpanalysis.org/blog/index.php/2009/10/15/essential-and-derived-properties/#comment-99409 Thanks for this info! Will try - I have at least 2 more dumps to check the file size :-) Thanks for this info! Will try - I have at least 2 more dumps to check the file size :-)

]]> By: Scott https://www.dumpanalysis.org/blog/index.php/2009/10/15/essential-and-derived-properties/#comment-99403 Scott Fri, 16 Oct 2009 15:02:28 +0000 https://www.dumpanalysis.org/blog/index.php/2009/10/15/essential-and-derived-properties/#comment-99403 Actually, in this case SectionSize would be a better representation of the amount of disk space consumed by the file. That shadows the AllocationSize of the file, which is the actual amount of disk space reserved for the file (i.e. it's a multiple of cluster size). FileSize is a shadow of the FileSize for the file, which is the EndOfFile marker. EOF is always <= AllocationSize. Also, since the cache manager state is only present for cached files, you might want to get the size information from the FsContext field. File systems set this field to a pointer to a FSRTL_COMMON_FCB_HEADER structure, which is where the size information comes from in the first place. -scott Actually, in this case SectionSize would be a better representation of the amount of disk space consumed by the file. That shadows the AllocationSize of the file, which is the actual amount of disk space reserved for the file (i.e. it’s a multiple of cluster size).

FileSize is a shadow of the FileSize for the file, which is the EndOfFile marker. EOF is always <= AllocationSize.

Also, since the cache manager state is only present for cached files, you might want to get the size information from the FsContext field. File systems set this field to a pointer to a FSRTL_COMMON_FCB_HEADER structure, which is where the size information comes from in the first place.

-scott

]]>