Retrieving ReFS integrity stream checksums

Question

Is it possible to retrieve the checksums/hashes that ReFS creates for integrity streams? I found this document which describes a new API control code: FSCTL_GET_INTEGRITY_INFORMATION, but it seems to only get some details about the integrity stream like checksum type and chunk size, not the checksums themselves.

I'm interested in this information because I'm writing a program that needs to identify file change more robustly than just file-name and time-stamp, and I'd hate to re-do all the checksumming that the filesystem is already doing, especially since I'm working with terabytes of data.

Answer 1

I think you are not supposed to access the checksums directly. There is one CRC64 checksum per 64 KB cluster in a file (you might get tons of them for large files). They are stored in a "private" way for the filesystem without an API access to it that i know. From what i know of the binary format in 2012R2, there is no ADS to access the checksums, you have to dig in the partition.

As for the initial concern, you may be interested in FILE_ATTRIBUTE_NO_SCRUB_DATA. Its purpose is "This attribute is useful for those applications that maintain their own integrity information, when the application developer wants tighter control over when and how those files are scrubbed.". That is close to what you want.