{
	"id": "fdb188ef-e93e-49e4-9437-818b59c36a97",
	"created_at": "2026-04-06T00:15:04.76507Z",
	"updated_at": "2026-04-10T13:12:16.263453Z",
	"deleted_at": null,
	"sha1_hash": "717d26e18c77a0b982efd4e5d358d009311203cd",
	"title": "Basic TxF Concepts - Win32 apps",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 42892,
	"plain_text": "Basic TxF Concepts - Win32 apps\r\nBy jwmsft\r\nArchived: 2026-04-05 16:58:33 UTC\r\nRead Isolation\r\nTransactional NTFS (TxF) provides read-committed consistency.\r\nA transacted writer refers to a transacted file handle opened with any permission that is not part of generic read\r\naccess but is part of generic write access. A transacted writer views the most recent version of a file that includes\r\nall of the changes by the same transaction. There can be only one transacted writer per file. Non-transacted writers\r\nare always blocked by a transacted writer, even if the file is opened with shared-write permissions.\r\nA transacted reader refers to a transacted file handle opened with any permission that is a part of generic read\r\naccess but is not part of generic write access. A transacted reader views a committed version of the file that\r\nexisted at the time the file handle was opened. The transacted reader is isolated from the effects of transacted\r\nwriters. This provides a consistent view of the file only for the life of the file handle and blocks non-transacted\r\nwriters.\r\nNote\r\nWhen a handle has been opened for modification with the CreateFileTransacted function, all subsequent opens\r\nof the file within that transaction whether read-only or not are converted by the system to be a transacted writer for\r\nthe purposes of isolation and other transactional semantics. This means that subsequently, when a handle is opened\r\nfor read-only access, the handle does not receive a view of the file prior to the start of the transaction; it receives\r\nthe active transaction view of the file.\r\nA non-transacted file handle does not see any changes made within a transaction until the transaction is\r\ncommitted. The non-transacted file handle receives an isolated view that is similar to a transacted reader, but\r\nunlike a transacted reader, it receives the file update when a transacted writer commits the transaction.\r\nIsolation Levels\r\nTxF provides read-committed isolation. This means that file updates are not seen outside the transaction. In\r\naddition, if a file is opened more than once while reading files within the transaction, you may see different results\r\nwith each subsequent opening. Files that were available the first time you accessed them may not be available\r\n(because they were deleted), or vice versa.\r\nTransactional Locking\r\nCreating a transacted writer on a file transactionally locks the file. After a file is locked by a transaction, other file\r\nsystem operations external to the locking transaction that try to modify the transactionally locked file will fail with\r\nhttps://msdn.microsoft.com/library/windows/desktop/dd979526.aspx\r\nPage 1 of 3\n\neither ERROR_SHARING_VIOLATION or ERROR_TRANSACTIONAL_CONFLICT.\r\nThe following table summarizes transactional locking.\r\nFile currently opened by\r\nFile open attempted by\r\nTransacted\r\nNon-Transacted\r\nReader\r\nReader/Writer\r\nReader\r\nReader/Writer\r\nTransacted Reader\r\nYes\r\nYes\r\nYes\r\nNo2\r\nTransacted Reader/Writer\r\nYes\r\nNo2\r\nYes\r\nNo2\r\nNon-Transacted Reader\r\nYes\r\nYes\r\nYes\r\nYes\r\nNon-Transacted Reader/Writer\r\nhttps://msdn.microsoft.com/library/windows/desktop/dd979526.aspx\r\nPage 2 of 3\n\nNo1\r\nNo1\r\nYes\r\nYes\r\n1. Fails with ERROR_TRANSACTIONAL_CONFLICT\r\n2. Fails with ERROR_SHARING_VIOLATION\r\nIf you open a named stream for a modification that is using a transaction, the entire file is required to be locked.\r\nIn addition to transactional locking, typical NTFS file-sharing rules apply.\r\nYou need to consider the following two file sharing modes in parallel:\r\nThe transactional locking mode.\r\nNormal file-sharing modes.\r\nWhichever mode is more restrictive is the one that applies.\r\nSource: https://msdn.microsoft.com/library/windows/desktop/dd979526.aspx\r\nhttps://msdn.microsoft.com/library/windows/desktop/dd979526.aspx\r\nPage 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://msdn.microsoft.com/library/windows/desktop/dd979526.aspx"
	],
	"report_names": [
		"dd979526.aspx"
	],
	"threat_actors": [],
	"ts_created_at": 1775434504,
	"ts_updated_at": 1775826736,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/717d26e18c77a0b982efd4e5d358d009311203cd.pdf",
		"text": "https://archive.orkl.eu/717d26e18c77a0b982efd4e5d358d009311203cd.txt",
		"img": "https://archive.orkl.eu/717d26e18c77a0b982efd4e5d358d009311203cd.jpg"
	}
}