SDIR

What metadata do files have?

Sdir allows a lot of metadata to be queried about files, and more capabilities can be added over time. The metadata to display can be specified on the command line for one time use, or specified in environment variables for a customized display.

To specify a metadata item to display on the command line, use -d followed by the name of the item. To hide a metadata item that is included by default, use -h followed by the name of the item. To include an item by default, set SDIR_OPTS to include -d followed by the name of the item. For example, to display the file's written date on the command line, use "sdir -dwd". To display file attributes by default, use "set SDIR_OPTS=-dfa".

Types of file metadata Sdir currently supports

Allocated range count (-dac)

Indicates the number of ranges in a sparse file that are allocated. A sparse file is only partially allocated, and may have zero allocated ranges (indicating it contains no allocation), or any number of allocated and deallocated ranges. For a non-sparse file, this value should be 1.

Access date (-dad)

Indicates the date that the file's contents were last read. Note that Windows since Vista does not maintain this information by default, so this value is only useful where it has been enabled with "fsutil behavior set disablelastaccess 0".

CPU architecture (-dar)

Indicates the architecture for any executable code. Common values are "None" indicating that the file does not appear to be executable code, "i386" indicating a 32-bit Windows binary, and "amd64" indicating a 64-bit Windows binary.

Allocation size (-das)

Indicates the amount of space that is allocated for the file. This may be larger than the file's size, since it includes additional space caused by alignment to file system cluster units.

Access time (-dat)

Indicates the time that the file's contents were last read. Note that Windows since Vista does not maintain this information by default, so this value is only useful where it has been enabled with "fsutil behavior set disablelastaccess 0".

Compression algorithm (-dca)

Indicates the compression algorithm used on the file, if the file has been compressed by file system compression. Common values include "None" to indicate no compression, "LZNT" to indicate NTFS compression, "Xp4" to indicate WOF Xpress compression with 4Kb chunks, and "WIM" to indicate a file whose contents come from a WIM archive.

Create date (-dcd)

Indicates the date that the file was initially created.

Compressed size (-dcs)

Indicates the amount of space that a compressed file uses on disk. For a non-compressed file, this is the same as allocation size.

Create time (-dct)

Indicates the time that the file was initially created.

Effective permissions (-dep)

Indicates the permissions that the currently logged on user has on the file. Currently displayed permissions are:

• R - The user can read file contents, or enumerate directory contents.
• r - The user can read file or directory metadata.
• W - The user can write file contents, or add files to a directory.
• w - The user can write file or directory metadata.
• A - The user can append file contents, or add directories to a directory.
• X - The user can execute the file, or traverse a directory. Directory traversal permission checks are disabled by default.
• D - The user can delete the file or directory.

File attributes (-dfa)

Displays file attributes. Currently displayed attributes are:

• A - The file's archive bit is set.
• R - The file is read only.
• H - The file is hidden.
• S - The file is a system file.
• D - The object is a directory.
• C - The file is compressed.
• E - The file is encrypted.
• O - The file is offline.
• r - The file contains a reparse point.
• s - The file is a sparse file.
• I - The file is a checksummed integrity file.

Fragment count (-dfc)

Displays the number of allocation fragments for a file. A defragmented file should have one fragment. A fragmented file can contain many.

File ID (-dfi)

Displays the file system's file identifier for the file.

File name (-dfn)

The long file name associated with the file. Displayed by default.

File size (-dfs)

The size of the contents of the file. Displayed by default.

Link count (-dlc)

The number of hardlinks to the file. For a file without hardlinks, this value is 1.

Named streams (-dns)

Displays all named streams attached to a file, and displays them as regular files.

Object ID (-doi)

Displays the object ID associated with the file, if one exists.

Minimum OS version (-dos)

Displays the minimum operating system version that can run the file, if the file is executable code.

Owner (-dow)

Displays the file owner.

Reparse tag (-drt)

Displays the reparse tag, if a reparse point is associated with the file.

Stream count (-dsc)

Displays the number of named streams associated with a file. To enumerate these streams, use -dns.

Summary (-dsm)

Displays the number number of files, space consumed, and space available on the volume at the end of regular display. Displayed by default.

Short name (-dsn)

Displays the short file name associated with the file, if one exists.

Subsystem (-dss)

Displays the subsystem type for executable code. Currently known subsystem types are:

• None - The file is not a recognized executable file.
• NT - The file is a native NT executable.
• GUI - The file is a Win32 graphical application.
• Cons - The file is a Win32 console application.
• Boot - The file is a Windows boot application.
• EFIa - The file is an EFI application.
• EFIb - The file is an EFI boot driver.
• EFId - The file is an EFI driver.
• EFIr - The file is an EFI ROM.

USN (-dus)

Displays the USN number associated with the file.

Version (-dvr)

Displays the file's version from its version resource. This value is only meaningful on executable files.

Write date (-dwd)

Indicates the date that the file was written to.

Write time (-dwt)

Indicates the time that the file was written to.