FSCTL_FIND_FILES_BY_SID control code

The FSCTL_FIND_FILES_BY_SID control code searches a directory for a file whose creator and owner matche the specified SID.

To perform this operation, minifilter drivers call FltFsControlFile with the following parameters, and file systems, redirectors, and legacy file system filter drivers call ZwFsControlFile with the following parameters.

Parameters

FileObject

FltFsControlFile only. The file object pointer for the directory to search. This parameter is required and cannot be NULL.

FileHandle

ZwFsControlFile only. The file handle for the directory to search. This parameter is required and cannot be NULL.

FsControlCode

A control code for the operation. Use FSCTL_FIND_FILES_BY_SID for this operation.

InputBuffer

A pointer to an input buffer that is described by the FIND_BY_SID_DATA structure. The FIND_BY_SID_DATA structure is defined as follows:


typedef struct {
  DWORD  ;
  SID  ;
} FIND_BY_SID_DATA, *PFIND_BY_SID_DATA;

Members

Restart

Indicates whether to restart the search. This member should be set to 1 on first call, so that the search will start from the root. For subsequent calls, this member should be set to zero so that the search will resume at the point where it stopped.

Sid

A structure of type SID that specifies the creator and owner.

InputBufferLength

The length, in bytes, of the buffer at InputBuffer.

OutputBuffer

A pointer to a caller-allocated array of quad-aligned FIND_BY_SID_OUTPUT structures that receive the fully qualified path names for each file. The FIND_BY_SID_OUTPUT structure is defined as follows:


typedef struct _FIND_BY_SID_OUTPUT {
  DWORD  ;
  DWORD  ;
  DWORD  ;
  WCHAR  [1];
} FIND_BY_SID_OUTPUT, *PFIND_BY_SID_OUTPUT;

Members

NextEntryOffset

Number of bytes that must be skipped to get to the next record. A value of zero indicates that this is the last record.

FileIndex

Index of the file.

FileNameLength

Size of the file name, in bytes.

FileName

A null-terminated string that specifies the file name.

OutputBufferLength

Size, in bytes, of the data returned in the buffer that is pointed to by the OutputBuffer parameter.

Remarks

When FltFsControlFile and ZwFsControlFile process the FSCTL_FIND_FILES_BY_SID control code, these routines check every file and directory on the volume. This operation might be slow if there are many files on the volume, even if the directory to search is very small.

See also

FltFsControlFile
SID
ZwFsControlFile

 

 

Send comments about this topic to Microsoft

Show:
© 2014 Microsoft