Can anyone recommend a good book or other resource on NTFS semantics?

Question

I'd like to improve my understanding of NTFS semantics; ideally, I'd like some kind of specification document(s).

I could (in theory) figure out the basics by experimentation, but there's always the possibility that I'd be ignoring some important variable.

For example, I'm having difficulty finding definitive information on the following:

(1) When do file times (created/modified/accessed) get set/updated? For example, does copying and/or moving a file affect any or all of these times? What about if the file is being copied/moved between volumes? What about alternate streams?

(2) How do sharing modes and read/write access interact?

(3) What happens to security information (SACL, DACL, ownership etc.) when a file is copied and/or moved?

As I said, I could probably "answer" these questions by writing some code, but that would only tell me how the specific operations I tested behaved across any machines that I ran the code on. I'd like to find a resource that can tell me how this stuff is supposed to behave, identifying all the variables that could affect the behaviour.

TIA!

Answer 1

Apparently there are no public non-NDA specifications. Projects such as NTFS-3G would greatly benefit from them, but they don't mention anything.

A predecessor of NTFS-3G, called linux-ntfs, has made some documentation on its own here. Maybe that's good enough for you, maybe not.