With regard to these trace statements:
DIAG - 2018-03-12 14:10:44.484 7668 Analyzing: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2379\Previous Files\02 Math and RNG\01 Vols\Touchdown Roulette.txt (0,478)[F,F] [0]
First DIAG statement indicates "Analyzing"
- after the filename are two numbers in parenthesis (page_offset, page_length)
- the values in braces will be T or F. The first indicates if a verify operation is required, and the second indicates if VRef (Index1) entry was found. If either are T the files will be processed.
- In this case [F,F] indicates no further processing required.
- The finale [0] is the USN journal entry value, in this case a zero value means no USN is used (i.e. no -maxf parameter on the archive command)
DIAG - 2018-03-12 14:10:44.625 7668 Analyzing: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2379\Previous Files\02 Math and RNG\01 Vols\Touchdown Roulette.txt(10.3 KB)[T,T] [0]
DIAG - 2018-03-12 14:10:44.656 7668 *** Pre-Processing alternate StreamId=0x8 (1012 bytes)DIAG - 2018-03-12 14:10:44.656 7668 *** Pre-Processing alternate StreamId=0x9 (8 bytes)DETAIL - 2018-03-12 14:10:44.656 7668 Archived-> Y:\Previous Files\02 Math and RNG\01 Vols\Touchdown Roulette.txt (10.3 KB) A-----ZL-O- [L] 10589 (0) bytes archived 31ms (333 KB/sec).
The second DIAG statement indicates "Analyzing"
- In this case [T,T] indicates verify required and no VRef entry, so the file will be processed.
- StreamID = 0x08 is a REPARSE Stream
- StreamID = 0x09 is a BACKUP_SPARSE_BLOCK
- both are valid stream types as long as the BACKUP_SPARSE_BLOCK has a length under 8MB which in this case it does, 8 bytes.
- the file is subsequently archived and '[L] 10589 (0) bytes' means the final data was linked to an existing blob, 10589 is the size, and (0) is the number of bytes stored.
- the attributes 'A-----ZL-O-' indicate"
A - Archive attribute
D - Directory
T - Temp file
S - System attribute
H - Hidden attribute
R - Read only attribute
Z - Sparse file
L - Reparse point
C - Compressed file
0 - Offline (stubbed) file
I - Do not content index
So in this case the files is: Read for archiving, Sparse, Reparse, and Offline. If this is a new stub, then this is expected behavior. If the same files keeps getting archived, then there's some issue.