File objects function as the logical interface between kernel and user-mode processes and the file data that resides on the physical disk. A file object contains both the data written to the file and the following set of kernel-maintained attributes.
|File name||Names the corresponding physical file.|
|Current byte offset||Used in synchronous file I/O (described later in this section) to identify the current starting location of read and write operations.|
|Share mode||Specifies whether a second process can open a file for read, write, or delete access while the initial process is still accessing it.|
|I/O mode||Specifies whether the initial process opened the file for synchronous or asynchronous I/O, cached or uncached I/O, sequential or random I/O, and so on.|
|Pointer to device object||Identifies the physical device the file data resides on.|
|Pointer to the volume parameter block, or VPB||Identifies the volume or partition the file data resides on.|
|Pointer to section object pointers||Identifies a root structure that describes a mapped file.|
|Pointer to private cache map||Identifies the file data that is currently cached.|
These attributes are defined as part of the FILE_OBJECT structure in Ntddk.h. Refer to the definition of this structure in the Windows Driver Kit (WDK) documentation for the data lengths and types of the values.