Certain Characters in a Filename are not Monitored on Change

Found a bug in "Everything"? report it here
Post Reply
therube
Posts: 2292
Joined: Thu Sep 03, 2009 6:48 pm

Certain Characters in a Filename are not Monitored on Change

Post by therube » Tue Sep 23, 2014 2:55 am

Certain (Unicode) Characters in a Filename are not Monitored on a Change, sometimes.
(oh, that's an ugly subject, but...)


Create the following two files, complete name, including the "arrows".
[copy & paste should suffice, for the filename]
[open wordpad, tell it to save, give it the names as below]

▶ TEST.TXT
▶ TEST.TXT2

Search for: test.txt

Both file names appear.

Rename "▶ TEST.TXT2" to "TEST.TXT2".
[do this with a 3rd-party file manager, as the issue is not seen when renamed in Everything or Windows Explorer. Altap Salamander or Multi Commander will do. Salamander will show the arrow as a '?' as it doesn't handle unicode. Multi Commander will display the arrow correctly. In both cases, you are able to rename the file, deleting the arrow.]

Both of the old names appear and the newly renamed TEST.TXT2.

Only "▶ TEST.TXT" & "TEST.TXT2" should show.


Don't know offhand if it's the particular character, or the particular character as the first "letter" in the file name, or ...?

therube
Posts: 2292
Joined: Thu Sep 03, 2009 6:48 pm

Re: Certain Characters in a Filename are not Monitored on Ch

Post by therube » Tue Sep 23, 2014 3:23 am

I thought I was seeing this when I used Multi Commander, but now I'm not sure?
As the last number of times I tried, renames within there worked (were reflected correctly in Everything).

But it is definitely not working when the files are renamed in Salamander.

void
Site Admin
Posts: 4830
Joined: Fri Oct 16, 2009 11:31 pm

Re: Certain Characters in a Filename are not Monitored on Ch

Post by void » Tue Sep 23, 2014 7:42 am

▶ TEST.TXT
▶ TEST.TXT2

Search for: test.txt

Both file names appear.

Rename "▶ TEST.TXT2" to "TEST.TXT2".
Working fine here with Salamander on Windows XP.

Are these files from a NTFS or folder index?
Can you please check if process explorer shows any open handles to these files?
If the issue is reproducible, could you please post verbose debug output when renaming the files.
This verbose debug output will show the USN journal changes.

therube
Posts: 2292
Joined: Thu Sep 03, 2009 6:48 pm

Re: Certain Characters in a Filename are not Monitored on Ch

Post by therube » Tue Sep 23, 2014 2:48 pm

4.5 MB .WMV:
https://drive.google.com/file/d/0B3rgcO ... sp=sharing

initially test directory [/tmp/sea/evee] is empty
Everything shows nothing in that directory

i copy the file names from the forum
create the files from within Multi Commander
x2

Multi Commander & Salamander both show the 2 files
Everything shows the 2 files (one additional from a different directory)

i jump to Salamander
rename "▶ TEST.TXT2" to "TEST.TXT2" by deleting the 1st character in the name
Salamander doesn't show it correctly, but does show a ? which is allowed to be deleted

Salamander shows the 2 files
but Everything shows 3 files

i jump back to Multi Commander
make a copy of one of the files, renaming it "222"
Everything shows 222
make a copy of 222, renaming it "333"
Everything shows 333

Salamander also show all as expected

Everything still shows "▶ TEST.TXT2", which no longer exists

within Salamander, i rename 333

Everything shows the old "▶ TEST.TXT333" & the renamed file TEST.TXT333


[didn't realize you can play it directly. when i went to download it, gave some bs message, "Too many users have viewed or downloaded this file recently". better i'd think if you can download. what a bunch of crap.]

therube
Posts: 2292
Joined: Thu Sep 03, 2009 6:48 pm

Re: Certain Characters in a Filename are not Monitored on Ch

Post by therube » Tue Sep 23, 2014 4:57 pm

Oh, seeing this on both XP & Win7.

> Are these files from a NTFS or folder index?

NTFS.

> check if process explorer shows any open handles to these files?

None.

therube
Posts: 2292
Joined: Thu Sep 03, 2009 6:48 pm

Re: Certain Characters in a Filename are not Monitored on Ch

Post by therube » Tue Sep 23, 2014 5:10 pm

Everything -debug
set search to: c:/tmp/ test.txt
copied ▶ TEST.TXT222 to ▶ TEST.TXT4444
renamed ▶ TEST.TXT4444 to TEST.TXT4444 in Salamander
▶ TEST.TXT4444 persists in Everything

Code: Select all

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\DEV\Locate>everything -debug

C:\DEV\Locate>Everything
Version 1.3.4.686 (x86)
Windows NT 5.1
Processors 2
IsAdmin 1
AppData 0
Service 1
default font MS Shell Dlg 2 -11
load everything icon
create mutex
bookmarks
set hook
create tray
db_load
new thread (0)
_db_filesystem_add 0: 0, 001933b8
_db_filesystem_add 1: 0, 00193450
_db_filesystem_add 2: 0, 001934d8
_db_filesystem_add 3: 0, 00193610
_db_filesystem_add 4: 0, 001936b8
_db_filesystem_add 5: 0, 001937f8
_db_filesystem_add 6: 0, 00193880
open volume \\?\Volume{80b65e57-1ead-11dd-a4f0-806d6172696f}
WM_ACTIVATE 00000001 00000000, lastfocus 00000000, current focus 00000000
enter setfocus
leave setfocus
invalidate
enter main loop
opened 1624 0.289997
open volume \\?\Volume{80b65e61-1ead-11dd-a4f0-806d6172696f}
opened 1624 0.336193
open volume \\?\Volume{80b65e59-1ead-11dd-a4f0-806d6172696f}
opened 1624 0.024534
open volume \\?\Volume{80b65e5a-1ead-11dd-a4f0-806d6172696f}
opened 1624 0.017789
open volume \\?\Volume{80b65e5b-1ead-11dd-a4f0-806d6172696f}
opened 1624 0.026582
open volume \\?\Volume{80b65e5c-1ead-11dd-a4f0-806d6172696f}
opened 1624 0.023659
open volume \\?\Volume{80b65e5d-1ead-11dd-a4f0-806d6172696f}
opened 1624 0.017987
loaded 0 of 0 changes in 0.002761 seconds
recent changes array memory usage: 0 bytes
loaded run history in 0.000641 seconds
run history data count: 37, data: 2310 bytes
run history ptr count: 34
total run history memory usage: 22810 bytes
update filesystem C:
open volume \\?\Volume{80b65e57-1ead-11dd-a4f0-806d6172696f}
opened 1632 0.015350
updated C: in 0.021267 seconds
update filesystem E:
open volume \\?\Volume{80b65e61-1ead-11dd-a4f0-806d6172696f}
opened 1632 0.011997
updated E: in 0.017479 seconds
update filesystem L:
open volume \\?\Volume{80b65e59-1ead-11dd-a4f0-806d6172696f}
opened 1632 0.006714
updated L: in 0.011968 seconds
update filesystem M:
open volume \\?\Volume{80b65e5a-1ead-11dd-a4f0-806d6172696f}
opened 1632 0.006755
updated M: in 0.011880 seconds
update filesystem O:
open volume \\?\Volume{80b65e5b-1ead-11dd-a4f0-806d6172696f}
opened 1632 0.005830
updated O: in 0.011116 seconds
update filesystem W:
open volume \\?\Volume{80b65e5c-1ead-11dd-a4f0-806d6172696f}
opened 1632 0.005867
updated W: in 0.011076 seconds
update filesystem X:
open volume \\?\Volume{80b65e5d-1ead-11dd-a4f0-806d6172696f}
opened 1632 0.005710
updated X: in 0.010739 seconds
loaded db in 1.158629 seconds
_DB_WAIT: _db_load_successful_proc waiting...
_DB_WAIT: _db_load_successful_proc waited 0.008685 seconds
start all monitors (7)
open volume \\?\Volume{80b65e57-1ead-11dd-a4f0-806d6172696f}
opened 1632 0.014596
open volume \\?\Volume{80b65e61-1ead-11dd-a4f0-806d6172696f}
opened 1628 0.010896
open volume \\?\Volume{80b65e59-1ead-11dd-a4f0-806d6172696f}
opened 1620 0.007381
open volume \\?\Volume{80b65e5a-1ead-11dd-a4f0-806d6172696f}
opened 1616 0.005759
open volume \\?\Volume{80b65e5b-1ead-11dd-a4f0-806d6172696f}
opened 1612 0.006277
open volume \\?\Volume{80b65e5c-1ead-11dd-a4f0-806d6172696f}
opened 1608 0.006085
open volume \\?\Volume{80b65e5d-1ead-11dd-a4f0-806d6172696f}
opened 1604 0.006144
open volume \\?\Volume{80b65e57-1ead-11dd-a4f0-806d6172696f}
search '' filter ''
term 00186560, flags: 1140, next: 00000000, notnext: 00000000
folderop: 0, fileop: 0, term:
opened 1596 0.015425
new thread (1)
open volume \\?\Volume{80b65e61-1ead-11dd-a4f0-806d6172696f}
found 56395 folders, size 262368, db search time taken: 0.000330 seconds
opened 1576 0.017383
found 697978 files, size 2820788, db search time taken: 0.005277 seconds
open volume \\?\Volume{80b65e59-1ead-11dd-a4f0-806d6172696f}
_DB_WAIT: db_get_selection_count waiting...
opened 1564 0.011933
_DB_WAIT: db_get_selection_count waited 0.011433 seconds
open volume \\?\Volume{80b65e5a-1ead-11dd-a4f0-806d6172696f}
opened 1556 0.012162
new thread (2)
open volume \\?\Volume{80b65e5b-1ead-11dd-a4f0-806d6172696f}
opened 1512 0.016578
open volume \\?\Volume{80b65e5c-1ead-11dd-a4f0-806d6172696f}
opened 1504 0.015578
open volume \\?\Volume{80b65e5d-1ead-11dd-a4f0-806d6172696f}
opened 1496 0.006332
WM_ACTIVATE 00000000 00000000, lastfocus 000301e0, current focus 000301e0
WM_DEVICECHANGE 00000007 00000000
WM_DEVICECHANGE 00000007 00000000
update filesystem E:
updated E: in 0.000154 seconds
_DB_WAIT: _db_ready_proc waiting...
_DB_WAIT: _db_ready_proc waited 0.000077 seconds
update filesystem E:
updated E: in 0.000058 seconds
_DB_WAIT: _db_ready_proc waiting...
_DB_WAIT: _db_ready_proc waited 0.000065 seconds
update filesystem C:
updated C: in 0.000206 seconds
_DB_WAIT: _db_ready_proc waiting...
_DB_WAIT: _db_ready_proc waited 0.000066 seconds
update filesystem C:
updated C: in 0.009477 seconds
_DB_WAIT: _db_ready_proc waiting...
_DB_WAIT: _db_ready_proc waited 0.000071 seconds
update filesystem C:
updated C: in 0.000456 seconds
_DB_WAIT: _db_ready_proc waiting...
_DB_WAIT: _db_ready_proc waited 0.000360 seconds
WM_ACTIVATE 00000001 00000000, lastfocus 000301e0, current focus 00000000
search 'c' filter ''
term 001cada8, flags: 1140, next: 00000000, notnext: 00000000
folderop: 2, fileop: 2, term: c
new thread (3)
found 17600 folders, size 131144, db search time taken: 0.004877 seconds
found 289343 files, size 1180784, db search time taken: 0.054390 seconds
_DB_WAIT: _db_ready_proc waiting...
_DB_WAIT: _db_ready_proc waited 0.000085 seconds
search 'c:' filter ''
FOLDER ROOT C: STARTWITH c:
term 00240fe0, flags: 1144, next: 00000000, notnext: 00000000
folderop: 202, fileop: 202, term: c:
found 20262 folders, size 131152, db search time taken: 0.001495 seconds
_DB_WAIT: db_get_result_count waiting...
found 204134 files, size 852772, db search time taken: 0.018307 seconds
_DB_WAIT: db_get_result_count waited 0.013672 seconds
search 'c:/tmp/ test.txt' filter ''
FOLDER SEARCH C:\TMP
term 0017c3f8, flags: 1144, next: 010904c8, notnext: 00000000
folderop: 192, fileop: 192, term: c:\tmp\
term 010904c8, flags: 1140, next: 00000000, notnext: 00000000
folderop: 2, fileop: 2, term: test.txt
_DB_WAIT: db_get_result_count waiting...
found 0 folders, size 0, db search time taken: 0.001975 seconds
found 8 files, size 65540, db search time taken: 0.015328 seconds
_DB_WAIT: db_get_result_count waited 0.016925 seconds
WM_ACTIVATE 00000000 00000000, lastfocus 000301e0, current focus 000301e0
update filesystem C:
updated C: in 0.000158 seconds
_DB_WAIT: _db_ready_proc waiting...
_DB_WAIT: _db_ready_proc waited 0.000077 seconds
WM_ACTIVATE 00000001 00000000, lastfocus 000301e0, current focus 00000000
WM_ACTIVATE 00000000 00000000, lastfocus 000301e0, current focus 000301e0
WM_ACTIVATE 00000001 00000000, lastfocus 000301e0, current focus 00000000
WM_ACTIVATE 00000000 00000000, lastfocus 000301e0, current focus 000301e0

therube
Posts: 2292
Joined: Thu Sep 03, 2009 6:48 pm

Re: Certain Characters in a Filename are not Monitored on Ch

Post by therube » Tue Sep 23, 2014 5:42 pm

Ah, these "dead" entries have no date/size.

Image

void
Site Admin
Posts: 4830
Joined: Fri Oct 16, 2009 11:31 pm

Re: Certain Characters in a Filename are not Monitored on Ch

Post by void » Wed Sep 24, 2014 8:16 am

Thanks for the debug output, therube.

Sorry, could you please send the verbose debug output.

You will need to run Everything with the -verbose -debug command line options:

Code: Select all

Everything.exe -debug -verbose
What is displayed in the debug console when you rename the file again?

The verbose mode will display USN journal events which should highlight the issue.

Also, do you have any exclude settings?

therube
Posts: 2292
Joined: Thu Sep 03, 2009 6:48 pm

Re: Certain Characters in a Filename are not Monitored on Ch

Post by therube » Wed Sep 24, 2014 2:35 pm

Maybe it has to do with the SFN being used for RENAME_OLD_NAME?
At that point, I would have been using Salamander to do that rename,
from "▶ TEST.TXT333" to TEST.TXT333.

So is it that the SFN ends up being destroyed, but not the LFN?

> do you have any exclude settings?

No.

Is there perhaps an issue on the Salamander side?

Code: Select all

updated E: in 0.000356 seconds
MSG: 000f017a 0402 00000000 00000000
EVENT: 00414ac0 00184d28
EVENT: 0045eb40 00173958
_DB_WAIT: _db_ready_proc waiting...
_DB_WAIT: _db_ready_proc waited 0.000082 seconds
MSG: 00630182 000f 00000000 00000000
MSG: 001001dc 000f 00000000 00000000
MSG: 000f017a 0402 00000000 00000000
EVENT: 00464af0 00173958
create thread
update filesystem E:
USN_RECORD 126138944, FLAGS 00002020, PARENT FRN 281474976720906, FRN 46724846133984648, reason
DATA_OVERWRITE (00000001), filename NOTEPAD.EXE-2F2D61E1.pf
updated E: in 0.000131 seconds
MSG: 000f017a 0402 00000000 00000000
EVENT: 0045eb40 00173958
_DB_WAIT: _db_ready_proc waiting...
_DB_WAIT: _db_ready_proc waited 0.000060 seconds
MSG: 000f017a 0402 00000000 00000000
EVENT: 00464af0 00173958
create thread
update filesystem C:
USN_RECORD 1107564696, FLAGS 00000020, PARENT FRN 41376821576501450, FRN 46161896180586349, reas
on FILE_CREATE (00000100), filename Γû╢ TEST.TXT2
USN_RECORD 1107564784, FLAGS 00000020, PARENT FRN 41376821576501450, FRN 46161896180586349, reas
on CLOSE FILE_CREATE (80000100), filename Γû╢ TEST.TXT2
updated C: in 0.000283 seconds
MSG: 000f017a 0402 00000000 00000000
EVENT: 00414ac0 00184d28
EVENT: 0045eb40 00173958
_DB_WAIT: _db_ready_proc waiting...
_DB_WAIT: _db_ready_proc waited 0.000042 seconds
MSG: 00630182 000f 00000000 00000000
MSG: 001001dc 000f 00000000 00000000
MSG: 000f0164 000f 00000000 00000000
MSG: 000f017a 0402 00000000 00000000
EVENT: 00464af0 00173958
create thread
update filesystem C:
USN_RECORD 1107564872, FLAGS 00000020, PARENT FRN 41376821576501450, FRN 46161896180586349, reas
on DATA_EXTEND (00000002), filename Γû╢ TEST.TXT2
USN_RECORD 1107564960, FLAGS 00000020, PARENT FRN 41376821576501450, FRN 46161896180586349, reas
on CLOSE DATA_EXTEND (80000002), filename Γû╢ TEST.TXT2
updated C: in 0.003241 seconds
MSG: 000f017a 0402 00000000 00000000
EVENT: 00414ac0 00184d28
EVENT: 0045eb40 00173958
_DB_WAIT: _db_ready_proc waiting...
_DB_WAIT: _db_ready_proc waited 0.000757 seconds
MSG: 00630182 000f 00000000 00000000
MSG: 001001dc 000f 00000000 00000000
MSG: 000f017a 0402 00000000 00000000
EVENT: 00464af0 00173958
create thread
update filesystem E:
USN_RECORD 126139056, FLAGS 00002020, PARENT FRN 281474976720906, FRN 46724846133984648, reason
DATA_OVERWRITE DATA_TRUNCATION (00000005), filename NOTEPAD.EXE-2F2D61E1.pf
USN_RECORD 126139168, FLAGS 00002020, PARENT FRN 281474976720906, FRN 46724846133984648, reason
DATA_EXTEND DATA_OVERWRITE DATA_TRUNCATION (00000007), filename NOTEPAD.EXE-2F2D61E1.pf
USN_RECORD 126139280, FLAGS 00002020, PARENT FRN 281474976720906, FRN 46724846133984648, reason
CLOSE DATA_EXTEND DATA_OVERWRITE DATA_TRUNCATION (80000007), filename NOTEPAD.EXE-2F2D61E1.pf
updated E: in 0.000349 seconds
MSG: 000f017a 0402 00000000 00000000
EVENT: 00414ac0 00184d28
EVENT: 0045eb40 00173958
_DB_WAIT: _db_ready_proc waiting...
_DB_WAIT: _db_ready_proc waited 0.000060 seconds
MSG: 00630182 000f 00000000 00000000
MSG: 001001dc 000f 00000000 00000000
MSG: 000f017a 0402 00000000 00000000
EVENT: 00464af0 00173958
create thread
update filesystem E:
USN_RECORD 126139392, FLAGS 00002020, PARENT FRN 281474976720906, FRN 46724846133984648, reason
DATA_OVERWRITE (00000001), filename NOTEPAD.EXE-2F2D61E1.pf
updated E: in 0.000131 seconds
MSG: 000f017a 0402 00000000 00000000
EVENT: 0045eb40 00173958
_DB_WAIT: _db_ready_proc waiting...
_DB_WAIT: _db_ready_proc waited 0.000060 seconds
MSG: 000f017a 0402 00000000 00000000
EVENT: 00464af0 00173958
create thread
update filesystem C:
USN_RECORD 1107565048, FLAGS 00000020, PARENT FRN 281474976710705, FRN 8725724278071613, reason
FILE_CREATE (00000100), filename WxpSymlinkTest
MSG: 000f017a 0402 00000000 00000000
updated C: in 0.000235 seconds
EVENT: 00414ac0 00184d28
EVENT: 0045eb40 00173958
_DB_WAIT: _db_ready_proc waiting...
_DB_WAIT: _db_ready_proc waited 0.000060 seconds
MSG: 000f017a 0402 00000000 00000000
MSG: 00630182 000f 00000000 00000000
MSG: 001001dc 000f 00000000 00000000
MSG: 000f0164 000f 00000000 00000000
MSG: 000f017a 0402 00000000 00000000
EVENT: 00464af0 00173958
create thread
update filesystem C:
USN_RECORD 1107565136, FLAGS 00000020, PARENT FRN 281474976710705, FRN 8725724278071613, reason
DATA_EXTEND FILE_CREATE (00000102), filename WxpSymlinkTest
USN_RECORD 1107565224, FLAGS 00000020, PARENT FRN 281474976710705, FRN 8725724278071613, reason
CLOSE DATA_EXTEND FILE_CREATE (80000102), filename WxpSymlinkTest
USN_RECORD 1107565312, FLAGS 00000020, PARENT FRN 281474976710705, FRN 9007199254786203, reason
FILE_CREATE (00000100), filename WxpSymlinkTest_Symlink
USN_RECORD 1107565416, FLAGS 00000420, PARENT FRN 281474976710705, FRN 9007199254786203, reason
FILE_CREATE (00100100), filename WxpSymlinkTest_Symlink
USN_RECORD 1107565520, FLAGS 00000420, PARENT FRN 281474976710705, FRN 9007199254786203, reason
CLOSE FILE_CREATE (80100100), filename WxpSymlinkTest_Symlink
USN_RECORD 1107565624, FLAGS 00000420, PARENT FRN 281474976710705, FRN 9007199254786203, reason
CLOSE FILE_DELETE (80000200), filename WxpSymlinkTest_Symlink
USN_RECORD 1107565728, FLAGS 00000020, PARENT FRN 281474976710705, FRN 8725724278071613, reason
CLOSE FILE_DELETE (80000200), filename WxpSymlinkTest
USN_RECORD 1107565816, FLAGS 00000020, PARENT FRN 41376821576501450, FRN 9007199254782269, reaso
n FILE_CREATE (00000100), filename Copy of Γû╢ TEST.TXT2
USN_RECORD 1107565920, FLAGS 00000020, PARENT FRN 41376821576501450, FRN 9007199254782269, reaso
n DATA_EXTEND FILE_CREATE (00000102), filename Copy of Γû╢ TEST.TXT2
USN_RECORD 1107566024, FLAGS 00000020, PARENT FRN 41376821576501450, FRN 9007199254782269, reaso
n BASIC_INFO_CHANGE DATA_EXTEND FILE_CREATE (00008102), filename Copy of Γû╢ TEST.TXT2
USN_RECORD 1107566128, FLAGS 00000020, PARENT FRN 41376821576501450, FRN 9007199254782269, reaso
n BASIC_INFO_CHANGE DATA_EXTEND DATA_OVERWRITE FILE_CREATE (00008103), filename Copy of Γû╢ TEST
.TXT2
USN_RECORD 1107566232, FLAGS 00000020, PARENT FRN 41376821576501450, FRN 9007199254782269, reaso
n BASIC_INFO_CHANGE CLOSE DATA_EXTEND DATA_OVERWRITE FILE_CREATE (80008103), filename Copy of Γû
╢ TEST.TXT2
MSG: 000f017a 0402 00000000 00000000
updated C: in 0.001179 seconds
EVENT: 00414ac0 00184d28
EVENT: 0045eb40 00173958
_DB_WAIT: _db_ready_proc waiting...
_DB_WAIT: _db_ready_proc waited 0.000059 seconds
MSG: 000f017a 0402 00000000 00000000
MSG: 00630182 000f 00000000 00000000
MSG: 001001dc 000f 00000000 00000000
MSG: 000f017a 0402 00000000 00000000
EVENT: 00464af0 00173958
create thread
update filesystem C:
USN_RECORD 1107566336, FLAGS 00000020, PARENT FRN 41376821576501450, FRN 9007199254782269, reaso
n RENAME_OLD_NAME (00001000), filename Copy of Γû╢ TEST.TXT2
USN_RECORD 1107566440, FLAGS 00000020, PARENT FRN 41376821576501450, FRN 9007199254782269, reaso
n RENAME_NEW_NAME (00002000), filename Γû╢ TEST.TXT333
USN_RECORD 1107566592, FLAGS 00000020, PARENT FRN 41376821576501450, FRN 9007199254782269, reaso
n CLOSE RENAME_NEW_NAME (80002000), filename Γû╢ TEST.TXT333
MSG: 000f017a 0402 00000000 00000000
updated C: in 0.000461 seconds
EVENT: 00414ac0 00184d28
EVENT: 0045eb40 00173958
_DB_WAIT: _db_ready_proc waiting...
_DB_WAIT: _db_ready_proc waited 0.000094 seconds
MSG: 000f017a 0402 00000000 00000000
MSG: 00630182 000f 00000000 00000000
MSG: 001001dc 000f 00000000 00000000
MSG: 000f017a 0402 00000000 00000000
EVENT: 00464af0 00173958
create thread
update filesystem C:
USN_RECORD 1107566680, FLAGS 00000020, PARENT FRN 41376821576501450, FRN 9007199254782269, reaso
n RENAME_OLD_NAME (00001000), filename TEST~3.TXT
USN_RECORD 1107566760, FLAGS 00000020, PARENT FRN 41376821576501450, FRN 9007199254782269, reaso
n RENAME_NEW_NAME (00002000), filename TEST.TXT333
USN_RECORD 1107566848, FLAGS 00000020, PARENT FRN 41376821576501450, FRN 9007199254782269, reaso
n CLOSE RENAME_NEW_NAME (80002000), filename TEST.TXT333
updated C: in 0.000359 seconds
MSG: 000f017a 0402 00000000 00000000
EVENT: 00414ac0 00184d28
EVENT: 0045eb40 00173958
_DB_WAIT: _db_ready_proc waiting...
_DB_WAIT: _db_ready_proc waited 0.000041 seconds
MSG: 00630182 000f 00000000 00000000
MSG: 001001dc 000f 00000000 00000000
MSG: 000f0164 000f 00000000 00000000
WM_ACTIVATE 00000001 00000000, lastfocus 0030023c, current focus 00000000
MSG: 00a60270 000f 00000000 00000000
MSG: 002a0234 000f 00000000 00000000
MSG: 0030023c 000f 00000000 00000000
MSG: 0062015a 000f 00000000 00000000
MSG: 00630182 000f 00000000 00000000
MSG: 001001dc 000f 00000000 00000000
MSG: 000f0164 000f 00000000 00000000
MSG: 00500240 0113 00000001 00000000
MSG: 0030023c 0118 0000ffff bf8c225d
MSG: 0030023c 0118 0000ffff bf8c225d
MSG: 0030023c 0118 0000ffff bf8c225d
MSG: 0030023c 0100 00000028 01500001
MSG: 0030023c 000f 00000000 00000000
MSG: 00630182 000f 00000000 00000000
MSG: 000f0164 000f 00000000 00000000
MSG: 00630182 0101 00000028 c1500001
MSG: 00500240 0113 00000001 00000000
MSG: 00630182 0100 00000010 01360001
MSG: 00630182 0100 00000009 000f0001
MSG: 0030023c 000f 00000000 00000000
MSG: 00630182 000f 00000000 00000000
MSG: 0030023c 0101 00000009 c00f0001
MSG: 0030023c 0101 00000010 c1360001
MSG: 00500240 0113 00000001 00000000
MSG: 0030023c 0100 00000043 002e0001
MSG: 0030023c 0102 00000063 002e0001
search 'c' filter ''
term 00186f48, flags: 1140, next: 00000000, notnext: 00000000
folderop: 2, fileop: 2, term: c
create thread
create thread
create thread
new thread (3)
found 17603 folders, size 131144, db search time taken: 0.005312 seconds
create thread
create thread
found 289879 files, size 1180788, db search time taken: 0.045370 seconds
EVENT: 00414ac0 00184d28
EVENT: 0045eb40 00173958
_DB_WAIT: _db_ready_proc waiting...
_DB_WAIT: _db_ready_proc waited 0.000059 seconds
create thread
create thread
EVENT: 00454940 00184d28
EVENT: 00454940 00184d28
EVENT: 00454940 00184d28
EVENT: 00454940 00184d28
search 'c:/tmp/ test.txt' filter ''
FOLDER SEARCH C:\TMP
term 00197d90, flags: 1144, next: 00197d38, notnext: 00000000
folderop: 192, fileop: 192, term: c:\tmp\
term 00197d38, flags: 1140, next: 00000000, notnext: 00000000
folderop: 2, fileop: 2, term: test.txt
create thread
create thread
create thread
found 0 folders, size 0, db search time taken: 0.001810 seconds
create thread
create thread
found 5 files, size 65540, db search time taken: 0.015698 seconds
search 'c:/tmp/ test.txt' filter ''
_DB_WAIT: db_query waiting...
_DB_WAIT: db_query waited 0.000114 seconds
FOLDER SEARCH C:\TMP
term 00161f68, flags: 1144, next: 00161f38, notnext: 00000000
folderop: 192, fileop: 192, term: c:\tmp\
term 00161f38, flags: 1140, next: 00000000, notnext: 00000000
folderop: 2, fileop: 2, term: test.txt
create thread
create thread
MSG: 000f017a 0402 00000000 00000000
create thread
EVENT: 0045eb40 00173958
MSG: 002a0234 000f 00000000 00000000
found 0 folders, size 0, db search time taken: 0.001542 seconds
create thread
create thread
MSG: 001001dc 000f 00000000 00000000
MSG: 000f0164 000f 00000000 00000000
MSG: 0030023c 0118 0000ffff bf8c225d
found 5 files, size 65540, db search time taken: 0.015713 seconds
MSG: 000f017a 0402 00000000 00000000
EVENT: 00414ac0 00184d28
EVENT: 0045eb40 00173958
_DB_WAIT: _db_ready_proc waiting...
_DB_WAIT: _db_ready_proc waited 0.000067 seconds
MSG: 00630182 000f 00000000 00000000
create thread
create thread
MSG: 000f017a 0402 00000000 00000000
EVENT: 00454940 00184d28
EVENT: 00454940 00184d28
MSG: 00630182 000f 00000000 00000000
MSG: 001001dc 000f 00000000 00000000
MSG: 000f0164 000f 00000000 00000000
MSG: 000f017a 0402 00000000 00000000
EVENT: 00454940 00184d28
MSG: 00630182 000f 00000000 00000000
MSG: 000f017a 0402 00000000 00000000
EVENT: 00454940 00184d28
EVENT: 00454940 00184d28
EVENT: 00454940 00184d28
MSG: 0030023c 0101 0000000d c01c0001
MSG: 0030023c 0118 0000ffff bf8c225d
MSG: 0030023c 0118 0000ffff bf8c225d
MSG: 0030023c 0118 0000ffff bf8c225d
MSG: 0030023c 0118 0000ffff bf8c225d
MSG: 0030023c 0118 0000ffff bf8c225d
MSG: 0030023c 0118 0000ffff bf8c225d
MSG: 0030023c 0118 0000ffff bf8c225d
MSG: 0030023c 0118 0000ffff bf8c225d
MSG: 0030023c 0118 0000ffff bf8c225d
WM_ACTIVATE 00000000 00000000, lastfocus 0030023c, current focus 0030023c
WM_ACTIVATE 00000001 00000000, lastfocus 0030023c, current focus 00000000
MSG: 0030023c 000f 00000000 00000000
WM_ACTIVATE 00000000 00000000, lastfocus 0030023c, current focus 0030023c
MSG: 0030023c 000f 00000000 00000000
MSG: 00500240 0113 00000001 00000000
MSG: 00500240 0219 00000007 00000000
MSG: 00cb0214 0219 00000007 00000000
MSG: 00a60270 0219 00000007 00000000
MSG: 000f017a 0219 00000007 00000000
WM_DEVICECHANGE 00000007 00000000
MSG: 0058024c 0219 00000007 00000000

void
Site Admin
Posts: 4830
Joined: Fri Oct 16, 2009 11:31 pm

Re: Certain Characters in a Filename are not Monitored on Ch

Post by void » Thu Sep 25, 2014 11:14 am

Thanks for the verbose debug output.

The short file name should not be used for the RENAME_OLD_NAME, although in this case it is.
I was still unable to reproduce it my end. Even trying to rename the file with the SFN and with Salamander.

Perhaps this MFT entry is fragmented, I will need to look into it more.

Disabling 8.3 file name creation may fix the issue for future filenames:
http://support.microsoft.com/kb/121007

therube
Posts: 2292
Joined: Thu Sep 03, 2009 6:48 pm

Re: Certain Characters in a Filename are not Monitored on Ch

Post by therube » Sat Dec 13, 2014 4:09 am

Just to note, I've seen this again with the (Turkish it would seem) word:

sımsıcak

Those are not 'i's, but on renaming the "i" to i, again I was left with the phantom entries.

No big deal, just pointing out.

therube
Posts: 2292
Joined: Thu Sep 03, 2009 6:48 pm

Re: Certain Characters in a Filename are not Monitored on Ch

Post by therube » Sat Dec 13, 2014 3:16 pm

Also, it may depend on your search term as to whether you see the issue or not.

Like if you search on 'cak', you may not.
But if you search on 's ms cak' you will (or at least if I'm remembering correctly, I think that's how it turned out.)

therube
Posts: 2292
Joined: Thu Sep 03, 2009 6:48 pm

Re: Certain Characters in a Filename are not Monitored on Change

Post by therube » Sat Jan 19, 2019 4:14 pm

Files names that include non-ascii characters are not purged when renamed using a utility that changes the name by its short file name (SFN).
(Or maybe more generally files that are renamed using a utility that changes the name by its SFN?)

Original name:

Code: Select all

TESTING123 - Онлайн.mp4
Renamed (using Salamander, F2 to rename) to:

Code: Select all

TESTING123.mp4
Result in Everything:

Code: Select all

TESTING123 - Онлайн.mp4
TESTING123.mp4

Code: Select all

Everything
Version 1.4.1.924 (x86)
Windows NT 6.1
Processors 4
IsAdmin 0
AppData 0
Service 1
cmdline "C:\DEV\Locate\Everything.exe"
WM_ACTIVATE 00000000 00000000, lastfocus 010b0a64, current focus 010b0a64
update m 1 47989008
update index E:
USN DATA_TRUNCATION CONHOST.EXE-E6AFC9F5.pf
USN DATA_EXTEND DATA_TRUNCATION CONHOST.EXE-E6AFC9F5.pf
USN DATA_EXTEND DATA_TRUNCATION CLOSE CONHOST.EXE-E6AFC9F5.pf
updated E: in 0.003140 seconds
resume ntfs monitor 1
processed usn records in 0.000647 seconds
DB_WAIT: _db_ready_proc waiting...
DB_WAIT: _db_ready_proc waited 0.000148 seconds
new results 925720
update m 8 47990296
update index Y:
USN RENAME_OLD_NAME TESTIN~1.MP4
USN RENAME_NEW_NAME TESTING123.mp4
USN RENAME_NEW_NAME CLOSE TESTING123.mp4
updated Y: in 0.003782 seconds
resume ntfs monitor 8
processed usn records in 0.000454 seconds
DB_WAIT: _db_ready_proc waiting...
DB_WAIT: _db_ready_proc waited 0.000235 seconds
new results 925720
new results 2
WM_ACTIVATE 00000001 00000000, lastfocus 010b0a64, current focus 00000000
WM_ACTIVATE 00000000 00000000, lastfocus 010b0a64, current focus 010b0a64

void
Site Admin
Posts: 4830
Joined: Fri Oct 16, 2009 11:31 pm

Re: Certain Characters in a Filename are not Monitored on Change

Post by void » Sun Jan 20, 2019 1:25 am

USN RENAME_OLD_NAME TESTIN~1.MP4
USN RENAME_NEW_NAME TESTING123.mp4
USN RENAME_NEW_NAME CLOSE TESTING123.mp4
It's the same issue with detecting which hard link was reference from the USN entry.
The USN Journal uses only one hard link filename, usually the first WIN32 filename in the MFT (not the filename that was used in the rename).
Filenames are flaged as WIN32 or DOS, so it's odd that the DOS filename was picked, unless it was flagged as WIN32..

The plan is to look-up all WIN32 filenames in the MFT from the USN entry.
This will allow Everything to use the correct filename and update the date modified / size for all hard links.

therube
Posts: 2292
Joined: Thu Sep 03, 2009 6:48 pm

Re: Certain Characters in a Filename are not Monitored on Change

Post by therube » Sun Jan 20, 2019 12:34 pm

In this case, there is no "hard link" involved.
Simply renaming the name of a (simple) file.

Or are you saying that there exists a "hard link" between a SFN & a LFN?

void
Site Admin
Posts: 4830
Joined: Fri Oct 16, 2009 11:31 pm

Re: Certain Characters in a Filename are not Monitored on Change

Post by void » Mon Jan 21, 2019 4:43 am

Yes, SFN and LFN are essentially hard links.

Post Reply