Export (0) Print
Expand All
Expand Minimize

FltQueryInformationFile function

FltQueryInformationFile retrieves information for a given file.

Syntax


NTSTATUS FltQueryInformationFile(
  _In_       PFLT_INSTANCE Instance,
  _In_       PFILE_OBJECT FileObject,
  _Out_      PVOID FileInformation,
  _In_       ULONG Length,
  _In_       FILE_INFORMATION_CLASS FileInformationClass,
  _Out_opt_  PULONG LengthReturned
);

Parameters

Instance [in]

Opaque instance pointer for the caller. This parameter is required and cannot be NULL.

FileObject [in]

File object pointer for the file. This parameter is required and cannot be NULL.

FileInformation [out]

Pointer to a caller-allocated buffer that receives information about the file. The FileInformationClass parameter specifies the type of information. This parameter is required and cannot be NULL.

Length [in]

Size, in bytes, of the FileInformation buffer.

FileInformationClass [in]

Type of file information to be returned. One of the following.

ValueMeaning

FileAllInformation

Return a FILE_ALL_INFORMATION structure for the file.

FileAttributeTagInformation

Return a FILE_ATTRIBUTE_TAG_INFORMATION structure for the file.

FileBasicInformation

Return a FILE_BASIC_INFORMATION structure for the file.

FileCompressionInformation

Return a FILE_COMPRESSION_INFORMATION structure for the file.

FileEaInformation

Return a FILE_EA_INFORMATION structure for the file.

FileInternalInformation

Return a FILE_INTERNAL_INFORMATION structure for the file.

FileMoveClusterInformation

Return a FILE_MOVE_CLUSTER_INFORMATION structure for the file.

FileNameInformation

Return a FILE_NAME_INFORMATION structure for the file.

FileNetworkOpenInformation

Return a single FILE_NETWORK_OPEN_INFORMATION structure for the file.

FilePositionInformation

Return a single FILE_POSITION_INFORMATION structure for the file.

FileStandardInformation

Return a single FILE_STANDARD_INFORMATION structure for the file.

FileStreamInformation

Return a single FILE_STREAM_INFORMATION structure for the file.

FileHardLinkInformation

Return a FILE_LINKS_INFORMATION structure for the file.

 

LengthReturned [out, optional]

Pointer to a caller-allocated variable that receives the size, in bytes, of the information returned in the FileInformation buffer. This parameter is optional and can be NULL.

Return value

FltQueryInformationFile returns STATUS_SUCCESS or an appropriate NTSTATUS value such as the following:

Return codeDescription
STATUS_VOLUME_DISMOUNTED

The file resides on a volume that is not currently mounted. This is an error code.

 

Remarks

A minifilter driver calls FltQueryInformationFile to retrieve information for a given file. The file must currently be open.

FltQueryInformationFile returns zero in any member of a FILE_XXX_INFORMATION structure that is not supported by a particular file system.

Callers of FltQueryInformationFile must be running at IRQL = PASSIVE_LEVEL and with APCs enabled.

Note  Before calling this routine, call IoGetTopLevelIrp. If IoGetTopLevelIrp returns a non-NULL value, do not call the routine as this can cause a system deadlock.

Requirements

Header

Fltkernel.h (include Fltkernel.h)

Library

FltMgr.lib

IRQL

PASSIVE_LEVEL (see Remarks section)

See also

FILE_ALIGNMENT_INFORMATION
FILE_ATTRIBUTE_TAG_INFORMATION
FILE_BASIC_INFORMATION
FILE_INTERNAL_INFORMATION
FILE_NAME_INFORMATION
FILE_NETWORK_OPEN_INFORMATION
FILE_POSITION_INFORMATION
FILE_STANDARD_INFORMATION
FILE_STREAM_INFORMATION
FILE_LINKS_INFORMATION
FltQueryVolumeInformationFile
FltSetInformationFile
ZwQueryInformationFile

 

 

Send comments about this topic to Microsoft

Show:
© 2014 Microsoft