Unique file identifiers on NTFS and $Object_ID

Question

From articles I have found online there appears to be two forms of unique identifiers for files on NTFS:

• Using Windows API GetFileInformationByHandle(), we can get access to the struct BY_HANDLE_FILE_INFORMATION, which contains a volume serial number and a low/high file index. http://msdn.microsoft.com/en-us/library/aa363788(VS.85).aspx

• $Object_ID - The article http://blogs.technet.com/b/askcore/archive/2010/08/25/ntfs-file-attributes.aspx states:

$OBJECT_ID – This is an attribute that holds an ID. This ID is used by the Distributed Link Tracking Service. An example of how it is used would be found in shortcuts. Make a shortcut on your desktop that points to a file. Then move that file. The shortcut will still function because it is using a way to tack the source file other than just the path and file name.

Not all files will have an $OBJECT_ID attribute. In fact, it isn’t until an actual ID is to be assigned that the attribute is added to the file.

I am trying to understand when the Object ID is set. Here are a few questions:

1. When does the Object ID get assigned? It would appear based on the above article that in one scenario this occurs when a shortcut to a file is created.

2. Does the Object ID get assigned automatically when a file references another file, e.g. a Word document, which embeds a Visio diagram?

3. Do Object IDs only get assigned when Distributed Link Tracking is enabled/running or do they exist regardless of Distributed Link Tracking?

4. If I wanted to track a unique identifier for a file, would there be any advantage for me to use the Object ID (64 bytes) over the combined volume serial number and file index (low/high), which are 12 bytes combined.

Thanks, Elan

Answer 1

It All Depends On What You're Trying To Do. :)

The file index number, like the documentation says, is really only a good identifier for the file in NTFS (as opposed to FAT), but even then it can change if the file is deleted and recreated (think backup/restore), though you might actually consider that a bonus if you were looking to distinguish those.

It's probably best not to worry about the link tracking service with regard to object IDs, and instead think of them as something you can create/set/read, though again only in NTFS.

Object IDs have some overhead, whereas file IDs do not. For most applications, I would probably end up picking file reference numbers (even though they are potentially fragile).