FSCTL_FIND_FILES_BY_SID control code

The FSCTL_FIND_FILES_BY_SID control code searches a directory for a file whose creator and owner matches the specified security ID (SID).

To perform this operation, minifilter drivers call FltFsControlFile and file systems, redirectors, and legacy file system filter drivers call ZwFsControlFile with the following parameters.

Parameters

  • FileObject [in]: FltFsControlFile only. The file object pointer for the directory to search. This parameter is required and cannot be NULL.

  • FileHandle [in]: ZwFsControlFile only. The file handle for the directory to search. This parameter is required and cannot be NULL.

  • FsControlCode [in]: control code for the operation. Use FSCTL_FIND_FILES_BY_SID for this operation.

  • InputBuffer [in]: A pointer to an input buffer that is described by the FIND_BY_SID_DATA structure.

  • InputBufferLength [in]: The length, in bytes, of the buffer at InputBuffer.

  • OutputBuffer [out]: A pointer to a caller-allocated array of quad-aligned FIND_BY_SID_OUTPUT structures that receive the fully qualified path names for each file.

  • OutputBufferLength [out]: Size, in bytes, of the data returned in the buffer that is pointed to by the OutputBuffer parameter.

Remarks

When FltFsControlFile and ZwFsControlFile process the FSCTL_FIND_FILES_BY_SID control code, these routines check every file and directory on the volume. This operation might be slow if there are many files on the volume, even if the directory to search is very small.

See also

FltFsControlFile

SID

ZwFsControlFile