Edit

FSCTL_LOOKUP_STREAM_FROM_CLUSTER IOCTL (winioctl.h)

  • Article

Given a handle to a NTFS volume or a file on a NTFS volume, returns a chain of data structures that describes streams that occupy the specified clusters.

Important

FSCTL_LOOKUP_STREAM_FROM_CLUSTER is a very resource-intensive operation, and typically uses a very large amount of disk bandwidth, memory, and time. It is unlikely that much of this information will remain in cache so a second call to FSCTL_LOOKUP_STREAM_FROM_CLUSTER would take nearly as much time as the first call. For doing multiple lookups it's more efficient to use FSCTL_ENUM_USN_DATA to enumerate every MFT record and then use FSCTL_GET_RETRIEVAL_POINTERS to gather the data to map between clusters and streams.

To perform this operation, call the DeviceIoControl function with the following parameters.

BOOL DeviceIoControl(
  (HANDLE)       hDevice,               // handle to file, directory, or volume
  FSCTL_LOOKUP_STREAM_FROM_CLUSTER,     // dwIoControlCode
  (LPVOID)       lpInBuffer,            // input buffer
  (DWORD)        nInBufferSize,         // size of input buffer
  (LPVOID)       lpOutBuffer,           // output buffer
  (DWORD)        nOutBufferSize,        // size of output buffer
  (LPDWORD)      lpBytesReturned,       // number of bytes returned
  (LPOVERLAPPED) lpOverlapped           // OVERLAPPED structure
);

Remarks

In Windows 8 and Windows Server 2012, this code is supported by the following technologies.

Technology Supported
Server Message Block (SMB) 3.0 protocol No
SMB 3.0 Transparent Failover (TFO) No
SMB 3.0 with Scale-out File Shares (SO) No
Cluster Shared Volume File System (CsvFS) Yes

Requirements

Requirement Value
Minimum supported client Windows 7 [desktop apps only]
Minimum supported server Windows Server 2008 R2 [desktop apps only]
Header winioctl.h (include Windows.h)

See also