Developing more confidence when tracking renames via Read­Directory­ChangesW

A customer was using Read­Directory­ChangesW to monitor the contents of a directory, and they were concerned about the FILE_ACTION_RENAMED_OLD_FILE and FILE_ACTION_RENAMED_NEW_FILE pair of actions. The documentation doesn’t guarantee that the two always occur consecutively, or even that they always appear in pairs. For peace of mind, the customer was looking for a way to match up each FILE_ACTION_RENAMED_OLD_FILE with a FILE_ACTION_RENAMED_NEW_FILE to make sure they were tracking the rename properly.

Yes, you can do it by switching from Read­Directory­ChangesW. to Read­Directory­Changes­ExW and asking for Read­Directory­Notify­Extended­Information. This produces the FILE_NOTIFY_EXTENDED_INFORMATION structure, and that structure includes the FileId of the affected file. You can then match that up between the FILE_ACTION_RENAMED_OLD_FILE and FILE_ACTION_RENAMED_NEW_FILE to confirm that they are the two halves of the same rename operation.