File Objects

File objects function as the logical interface between kernel and user-mode processes and the file data that resides on the physical disk. A file object contains both the data written to the file and the following set of kernel-maintained attributes.

Information typePurpose
File nameNames the corresponding physical file.
Current byte offsetUsed in synchronous file I/O (described later in this section) to identify the current starting location of read and write operations.
Share modeSpecifies whether a second process can open a file for read, write, or delete access while the initial process is still accessing it.
I/O modeSpecifies whether the initial process opened the file for synchronous or asynchronous I/O, cached or uncached I/O, sequential or random I/O, and so on.
Pointer to device objectIdentifies the physical device the file data resides on.
Pointer to the volume parameter block, or VPB Identifies the volume or partition the file data resides on.
Pointer to section object pointersIdentifies a root structure that describes a mapped file.
Pointer to private cache mapIdentifies the file data that is currently cached.


These attributes are defined as part of the FILE_OBJECT structure in Ntddk.h. Refer to the definition of this structure in the Windows Driver Kit (WDK) documentation for the data lengths and types of the values.