MFT DataSize, AllocatedSize and LastWriteTime

[Matt]

Hi,



I'm writing some code that reads the FileName attribute file records from

the MFT by using the FSCTL_GET_NTFS_FILE_RECORD api call.



I've noticed that, for most records, the DataSize, AllocatedSize and

LastWriteTime are accurate when compared to the values in the win explorer

file properties dialog.However, for some more recent files/records the size

values are always 0 and the timestamp is incorrect.



Has anyone experienced this issue? I'm hoping to gain an understanding

of how/when NFTS updates the record with the correct values.



Thanks.

--

Matt