Random tip: if you're using procmon.exe to monitor file system activity, you'll see a FileAttributes field with a bunch of letters. It's not immediately obvious which letters correspond to which Win32 file attribute constants . I asked around internally...