Why didn’t Read­Directory­ChangesW provide a way to correlate the two sides of a rename operation?

The Old New Thing (Raymond Chen) Tools

Summary

Raymond Chen explains why the Windows API ReadDirectoryChangesW doesn't provide correlation for rename operations, due to an unwritten assumption that rename events are sequential, which may not hold with concurrent activities.

<p>Brian Dellisanti asked <a href="https://devblogs.microsoft.com/oldnewthing/20260508-00/?p=112310&amp;commentid=144190#comment-144190"> why <code>Read­Directory­ChangesW</code> didn&#8217;t provide a way to correlate the two sides of a rename operation</a>.</p> <p>I wasn&#8217;t there, but I can guess.</p> <p>My guess is that the implementation always generated the two events one right after the other, so &#8220;obviously&#8221; the way you correlate them is to save the old name when you see the <code>FILE_<wbr />ACTION_<wbr />RENAMED_<wbr />OLD_<wbr />NAME</code>, and when the <code>FILE_<wbr />ACTION_<wbr />RENAMED_<wbr />NEW_<wbr />NAME</code> comes immediately after, you have your two sides.</p> <p>But they never wrote down that the two events always occur in direct succession. Which meant that when new file systems came along, they might not honor the unwritten rule. If two files are being renamed at the same time, is it possible that the two sets of rename events end up interleaved? There was nothing written down to forbid it, so I guess it&#8217;s possible.</p> <p>Note that I don&#8217;t know whether any file systems actually break this unwritten rule. From what I can tell, they do generate the two events in rapid succession, but rapid succession doesn&#8217;t <i>a priori</i> guarantee that they will come directly one after the other, particularly if there is a lot of concurrent disk activity going on.</p> <p>In practice, I couldn&#8217;t find a lot of code tracking renames anyway. They generally treated the <code>FILE_<wbr />ACTION_<wbr />RENAMED_<wbr />OLD_<wbr />NAME</code> as a deletion and the <code>FILE_<wbr />ACTION_<wbr />RENAMED_<wbr />NEW_<wbr />NAME</code> as a creation. And the ones that did track renames assumed that renames did not interleave. (Not that they had much choice.)</p> <p>I don&#8217;t think that providing the file IDs for the two sides of a rename operation was the purpose of <code>Read­Directory­Changes­ExW</code>&#8216;s <code>Read­Directory­Notify­Extended­Information</code>. It was just a happy side effect that the extra information in the <code>Read­Directory­Notify­Extended­Information</code> also gives you the pieces needed to connect the dots reliably.</p> <p>I thought you might appreciate me pointing out the trick, that&#8217;s all.</p> <p>The post <a href="https://devblogs.microsoft.com/oldnewthing/20260914-00/?p=112696">Why didn&#8217;t &lt;CODE&gt;Read&shy;Directory&shy;ChangesW&lt;/CODE&gt; provide a way to correlate the two sides of a rename operation?</a> appeared first on <a href="https://devblogs.microsoft.com/oldnewthing">The Old New Thing</a>.</p>
Original Article
View Cached Full Text

Cached at: 09/15/26, 02:17 AM

# Why didn't Read­Directory­ChangesW provide a way to correlate the two sides of a rename operation? - The Old New Thing Source: [https://devblogs.microsoft.com/oldnewthing/20260914-00?p=112696](https://devblogs.microsoft.com/oldnewthing/20260914-00?p=112696) Brian Dellisanti asked[why`Read­Directory­ChangesW`didn’t provide a way to correlate the two sides of a rename operation](https://devblogs.microsoft.com/oldnewthing/20260508-00/?p=112310&commentid=144190#comment-144190)\. I wasn’t there, but I can guess\. My guess is that the implementation always generated the two events one right after the other, so “obviously” the way you correlate them is to save the old name when you see the`FILE\_ACTION\_RENAMED\_OLD\_NAME`, and when the`FILE\_ACTION\_RENAMED\_NEW\_NAME`comes immediately after, you have your two sides\. But they never wrote down that the two events always occur in direct succession\. Which meant that when new file systems came along, they might not honor the unwritten rule\. If two files are being renamed at the same time, is it possible that the two sets of rename events end up interleaved? There was nothing written down to forbid it, so I guess it’s possible\. Note that I don’t know whether any file systems actually break this unwritten rule\. From what I can tell, they do generate the two events in rapid succession, but rapid succession doesn’t*a priori*guarantee that they will come directly one after the other, particularly if there is a lot of concurrent disk activity going on\. In practice, I couldn’t find a lot of code tracking renames anyway\. They generally treated the`FILE\_ACTION\_RENAMED\_OLD\_NAME`as a deletion and the`FILE\_ACTION\_RENAMED\_NEW\_NAME`as a creation\. And the ones that did track renames assumed that renames did not interleave\. \(Not that they had much choice\.\) I don’t think that providing the file IDs for the two sides of a rename operation was the purpose of`Read­Directory­Changes­ExW`‘s`Read­Directory­Notify­Extended­Information`\. It was just a happy side effect that the extra information in the`Read­Directory­Notify­Extended­Information`also gives you the pieces needed to connect the dots reliably\. I thought you might appreciate me pointing out the trick, that’s all\. ### Category ### Topics ## Author ![Raymond Chen](https://devblogs.microsoft.com/oldnewthing/wp-content/uploads/sites/38/2019/02/RaymondChen_5in-150x150.jpg) Raymond has been involved in the evolution of Windows for more than 30 years\. In 2003, he began a Web site known as The Old New Thing which has grown in popularity far beyond his wildest imagination, a development which still gives him the heebie\-jeebies\. The Web site spawned a book, coincidentally also titled The Old New Thing \(Addison Wesley 2007\)\. He occasionally appears on the Windows Dev Docs Twitter account to tell stories which convey no useful information\.

Similar Articles

Why not have changes in API behavior depend on the SDK you link against?

The Old New Thing (Raymond Chen)

The article examines the pitfalls of altering API behavior depending on the linked SDK version, using Windows' CoInitializeSecurity as a case study. It discusses issues with DLL version mismatches and tail call optimization that complicate this approach.

A compatibility note on the abuse of Windows window class extra bytes

The Old New Thing (Raymond Chen)

Raymond Chen discusses a historical Windows compatibility issue where some 16-bit programs abused window class extra bytes to store private data, and how Microsoft blocked the loophole for 32-bit and 64-bit programs while maintaining backward compatibility.

Understanding the rationale behind a rule when trying to circumvent it

The Old New Thing (Raymond Chen)

This article from Microsoft's Old New Thing blog explains the rationale behind best practices for Windows kernel callback functions, particularly why blocking or waiting on work items defeats their purpose, using a cautionary tale about drivers causing system hangs.