What is this strange file name with a semicolon inside?

When you handle OnCreateFile and / or OnOpenFile request, you can get the file name with a semicolon (":") in it. This means that the request is made to create a named stream in a file. The part before the semicolon is the name of the file itself and the name after the semicolon is the name of the named stream.

Named streams are supported by NTFS and they are called Alternate Data Streams there. You can read about them in Wikipedia or MSDN .

Ready to get started?

Learn more about Callback Technologies or download a free trial.

Download Now