One of the admittedly greatest puzzles in Microsoft App-V usage has so far been the lack of visibility for the PKG files.

These PKG files – as all App-V admins very well know - basically contains file and registry data that has been cached for the user and for the machine after App-V enabled application has run on the client. To make things more complicated, it is just not user and machine data as such (like Sequencer presents the division with Application Data and User Data in UI) but it also involves the factor of who has made change in the client system. And “who”, in this context, being either present user or system itself. Before Softgrid 4.2 really, this was more clear-cut and simple: changes to files marked as Application Data/Config were visible to all users on the client machine whereas files marked as User Data/Config were visible only to user who initiated the change. But alas, not anymore.

On a physical level, App-V client caches data to several different PKG files depending on who’s change we are talking about:

  • UsrVol_sftfs_v1.pkg file in user’s own (roaming) Application data represents changes to files marked as User Data that are initiated by and visible to processes of that user (i.e. are running as that user), usually meaning applications you  (as user) launch and use from App-V package. This file also contains cached virtual environment configuration, which practically means changed virtual registry, for the user.
  • UsrVol_sftfs_v1.pkg file in per-machine App-V cache (C:\ProgramData\Microsoft\Application Virtualization Client\SoftGrid Client\AppFS Storage in Windows Vista and 7, under All Users -profile in earlier Windows versions) represents changes to files marked as User Data that are initiated by and are visible only to few selected Windows system processes (like winlogon.exe) having access to Q: drive.
  • GlblVol_sftfs_v1_user_SID.pkg file in per-machine App-V cache represents changes to files marked as Application Data that are initiated by and are visible to processes of user account having SID in PKG file’s name. Normally, you should see one with your account’s SID in there but on machines having multiple users there’s one for each.
  • And finally, we have GlblVol_sftfs_v1_S-1-5-20.pkg file in per-machine App-V cache representing changes to files marked as Application Data that are initiated by and are visible to system level processes running in the virtual environment. These processes are, for instance, virtual services started from the package. This file also contains cached virtual environment configuration for the system.

 So knowing that there’s multiple contexts involved for caching, how do we know what the heck is actually cached (as opposed to coming from original SFT) on the client since sometimes this is needed for troubleshooting purposes? Sad answer is that we actually do not know this, since App-V Client does not provide any tool to view cached information besides starting cmd.exe or such in the package’s VE and trying to poke around in system with registry editor etc. The problem of course is that this method does not provide any information which of the files or registry values differ from what we have from SFT itself as everything is merged down for us by App-V itself. Also, this method does not reveal contents of alternative contexts, since we (or our processes) are by definition operating under our own user account.

Thus, the holy quest for PKG viewer :-) Up until now, nobody has been able to produce such viewer (at least publicly!) and Microsoft has not been very forthcoming in opening up PKG fileformat (which incidentally is actually the same fileformat as App-V’s very own package cache, sftfs.fsd file, uses). But, in preparing for very near release of SFT Explorer, version 2.0, I decided to once and all to resolve this need and am happy to report that I have been able to do it!

Code is not finalized yet, but I know how to do it, and as a proof here’s four different view of cached [PKG] contents of Firefox 3.0 package that I have been running for ages on my machine:

Here’s how the UsrVol… -file looks like for the current user:

UsrVol_sftfs_v1.pkg for user

Here’s how the UsrVol… -file looks like for the system:

UsrVol_sftfs_v1.pkg for system

Here’s how the GblVol… looks like for the user:

GlblVol_sftfs_SID.pkg for user

And here’s how GblVol… looks like for the system:

GlblVol_sftfs_v1_S-1-5-20.pkg for system

As you can see, there’s clearly a vast difference how different processes see the world, and these screenshots are not even including virtual registry!

–

As stated above, this PKG viewing capability is now likely to be part of upcoming version of SFT Explorer, and to track things related to it I invite all to join to SFT Explorer Users -group in LinkedIn.