Based off a Process Monitor trace, when echo text > filename.txt
is ran, a call is made to CreateFile
with the dwCreationDisposition
flag set to CREATE_ALWAYS
, which
Creates a new file, always.
If the specified file exists and is writable, the function overwrites the file, the function succeeds, and last-error code is set to ERROR_ALREADY_EXISTS (183).
If the specified file does not exist and is a valid path, a new file is created, the function succeeds, and the last-error code is set to zero.
echo demo2 >> filename.txt
, on the otherhand, calls CreateFile
with CREATE_NEW
and opens the existing file. The process then gets the end of the file, reads one byte from the end and starts writing thereafter. I would guess it is looking for a ^Z
character at the end which it needs to overwrite when it reads the last character, but that is just a guess.