Find Out If Two HANDLEs are Hardlinks to the Same File

Question

(This question is a toughie... it might require knowledge of NTFS and/or the use of NT Native APIs; be warned.) :)

If I'm given two HANDLEs to two files, how can I definitively (not just with high probability) find out if the two HANDLEs belong to the exact same file and stream on the disk?

This means, for example, checking the 8-byte NTFS file IDs isn't enough, because two HANDLEs with the same file ID can be pointing to different data streams of the same file, and I need to find out if the two streams are really the same and only differ by the name (hardlink).

(What's the use? This way, if I want to perform an operation on all files inside a folder, I don't do the operation twice on the same data stream with different names.)

Answer 1

This requires GetFileInformationByHandleEx(), asking for FileStreamInfo. That returns the stream name.

This warning in the SDK docs should be noted:

Certain file information classes behave slightly differently on different operating system releases. These classes are supported by the underlying drivers, and any information they return is subject to change between operating system releases.

Avoid relying on recovering info that is (or should be) readily available in your program.