Calling FSCTL_CREATE_OR_GET_OBJECT_ID from Python

Question

I'm trying to get NTFS object IDs to use in a Python backup program. I'm in way over my head, but managed to create a function that returns... something.

import sys
import win32file
import winioctlcon


def object_id(filename):
    """
    NTFS OBJECT_ID
    """
    fhandle = win32file.CreateFileW(
        # FileName
        filename,

        # DesiredAccess
        win32file.GENERIC_READ,

        # ShareMode
        win32file.FILE_SHARE_READ | win32file.FILE_SHARE_WRITE,

        # SecurityAttributes
        None,

        # CreationDisposition
        win32file.OPEN_EXISTING,

        # FlagsAndAttributes
        0
        )

    obj_id = win32file.DeviceIoControl(
        # Device : PyHANDLE
        # Handle to a file, device, or volume
        fhandle,

        # IoControlCode : int
        # IOControl Code to use, from winioctlcon
        winioctlcon.FSCTL_CREATE_OR_GET_OBJECT_ID,

        # InBuffer : str/buffer
        # The input data for the operation, can be None for some operations.
        None,

        # OutBuffer : int/buffer
        # Size of the buffer to allocate for output, or a writeable buffer as
        # returned by win32file::AllocateReadBuffer.
        64,

        # Overlapped=None : PyOVERLAPPED An overlapped object for async
        # operations. Device handle must have been opened with
        # FILE_FLAG_OVERLAPPED.
        None
        )
    fhandle.Close()
    return obj_id

Some sample output from calling this function is a str like, "↑·∟âkòπ◄êδ %dΘπ╧hMêc▌Æ╧J¿/╧y╠┘ôπ↑·∟âkòπ◄êδ %dΘπ╧". That would be fine for the purposes of my program, as long as it's consistent for each file I'm backing up. But am I doing anything horribly wrong here? Ideally I'd like to implement this as correctly as possible.

score 2 · Answer 1 · answered Feb 16 '14 at 15:20

2

Yes. This is 100% valid.

You are returns three OBJECT_ID:

Object ID: 3FB73FE2-6BF2-3F3F-EA3F-2025643F3F3F

Birth Volume ID: 684DEA63-A6C6-2D4A-BF2F-2D79A62BF470

Birth Object ID: 3FB73FE2-6BF2-3F3F-EA3F-2025643F3F3F

This output is as expected. :)

answered Feb 16 '14 at 15:20

user2120666

579
1
4
16

How did you translate from the (crazy-looking) str value I gave above to those three alphanumerics?! – Ted Striker Feb 16 '14 at 17:04
Simply from your string as hex. – user2120666 Feb 16 '14 at 18:16
Can you show a Python function that converts my string to your hex strings? I have been trying to replicate your result all night! – Ted Striker Feb 17 '14 at 02:08
-1. @Ted Striker: I 'like' this questions. You are try do something without underneath knownledge. Why do you known OBJECT_ID, if you dont known what is it and what is formated? – Xearinox Feb 17 '14 at 06:57
I know what OBJECT_ID is and what it's supposed to be returning. What I was initially concerned about was whether I had used the foreign functions (DeviceIoControl, CreateFileW) totally correctly. Microsoft's docs are not great. I was also trying to find out what sort of codec or function user2120666 used, particularly when none I tried yielded those precise strings. As it turns out, I think he made a mistake. It looks like all the "3F"s are "?" characters substituted by a program where the input (e.g. "↑") was out of range. – Ted Striker Feb 17 '14 at 11:52

score 2 · Accepted Answer · answered Feb 17 '14 at 17:33

Using binascii.hexify() on the output str from my question yields: "18fa1c836b95e31188eb002564e9e3cf684d8863dd92cf4aa82fcf79ccd993e318fa1c836b95e31188eb002564e9e3cf00000000000000000000000000000000". This is the same result as:

C:\Windows\system32>fsutil.exe objectid query "myfile.txt"
Object ID :        18fa1c836b95e31188eb002564e9e3cf
BirthVolume ID :   684d8863dd92cf4aa82fcf79ccd993e3
BirthObjectId ID : 18fa1c836b95e31188eb002564e9e3cf
Domain ID :        00000000000000000000000000000000

So I have independent verification from fsutil.exe that my Python function is producing the right output.

I still don't know whether the Windows functions were used absolutely correctly, and would appreciate any corrections if they weren't.

Calling FSCTL_CREATE_OR_GET_OBJECT_ID from Python

2 Answers2

Linked