By now, a lot of my readers will be aware of the new ReFS file system in Windows 8. I personally believe ReFS will evolve, and will add support for some of the missing features. To recap, some of the features present in NTFS, but absent from ReFS (at least the ReFS in Windows 8 include:
- No support for Extended Attributes
- No support for Alternate Data Streams
- No support for quotas
- No support for bootable volumes
This is not a comprehensive list. I decided to look briefly at each of these features in a series of blog posts.
Extended Attributes are known to be used in two specific cases, if one believes some of the postings on the Internet, including on Technet forums. To be clear, I am not attributing these postings to Microsoft employees, I am simply saying users have posted on some Microsoft owned forums:
- Internet Explorer and Windows use Extended Attributes to mark files downloaded from the Internet and provide a security warning when the user attempts to execute the file.
- Windows Client Side Caching (yes, the name keeps evolving) uses Extended Attributes to mark files in its cache
What, if anything else, uses Extended Attributes ?
Since there was no convenient way, I wrote a small utility to examine a specified directory and inspect each of its component files and sub-directories to determine if any of them have Extended Attributes. I am happy to provide this utility free for any curious folks. I ran the utility on a Windows 8 Server box and a partial output is at the end of this blog.
What I found is that a number of Windows system files and directories use Extended Attributes.
It will be interesting to see what path Microsoft takes to improve ReFS functionality e.g. if and when Microsoft enhances ReFS to provide support for bootable volumes, will ReFS evolve to support Extended Attributes, or will Windows evolve to stop using Extended Attributes.
Here is the promised partial output
Directory \??\C:\Documents and Settings has Extended Attributes.
Directory \??\C:\ProgramData\Application Data has Extended Attributes.
Directory \??\C:\ProgramData\Desktop has Extended Attributes.
Directory \??\C:\ProgramData\Documents has Extended Attributes.
File \??\C:\ProgramData\Microsoft\Windows\Hyper-V\Resource Types6FF76FA-2D58-4BAF-9F8D-455773824F37.xml has Extended Attributes.
File \??\C:\ProgramData\Microsoft\Windows\Hyper-V\Resource Types\118C3BE5-0D31-4804-85F0-5C6074ABEA8F.xml has Extended Attributes.
File \??\C:\ProgramData\Microsoft\Windows\Hyper-V\Resource Types\146C56A0-3546-469B-9737-FCBCF82428F4.xml has Extended Attributes.
File \??\C:\ProgramData\Microsoft\Windows\Hyper-V\Resource Types\19839BFF-6F04-4B24-B4B5-1AFCCBE729DE.xml has Extended Attributes.
winntfs 
Comments
– The Distributed Link Tracking service in NT depends on Object IDs.
– The Windows servicing stack depends entirely on hard links.
– IE adds a named stream to every file it downloads as you already said
– File system transactions (TxF) are also extensively used by Windows Update, System Restore, and Task Scheduler
ReFS is completely half-baked at this point, unacceptably half-baked.
I thought Extended Attributes (originally an OS/2 concept) were implemented using named streams, aka Alternate Data Streams or ADS.
Anyway, IE, in addition to the usage you mentioned above, uses a named stream for favicons for “favorites’ (those little INI files with the extension “url”).
In Windows 8.1/Server 2012 R2, there is limited support for named streams on ReFS – they can be no larger than 128Kb. So CopyFile/CopyFileEx and other APIs will indeed copy named streams to an ReFS volume. Unless the stream is greater than 128Kb, in which case they’ll error out – error 665.
See my post here for more information: http://bakins-bits.com/wordpress/?p=140