Windows Dev Center

FSCTL_LOOKUP_STREAM_FROM_CLUSTER control code

Given a handle to a NTFS volume or a file on a NTFS volume, returns a chain of data structures that describes streams that occupy the specified clusters.

Important  FSCTL_LOOKUP_STREAM_FROM_CLUSTER is a very resource-intensive operation, and typically uses a very large amount of disk bandwidth, memory, and time. It is unlikely that much of this information will remain in cache so a second call to FSCTL_LOOKUP_STREAM_FROM_CLUSTER would take nearly as much time as the first call. For doing multiple lookups it's more efficient to use FSCTL_ENUM_USN_DATA to enumerate every MFT record and then use FSCTL_GET_RETRIEVAL_POINTERS to gather the data to map between clusters and streams.

To perform this operation, call the DeviceIoControl function with the following parameters.


DeviceIoControl( (HANDLE)       hDevice,           // handle to file, directory, or volume 
                 FSCTL_LOOKUP_STREAM_FROM_CLUSTER, // dwIoControlCode
                 (LPVOID)       lpInBuffer,        // input buffer 
                 (DWORD)        nInBufferSize,     // size of input buffer 
                 (LPVOID)       lpOutBuffer,       // output buffer 
                 (DWORD)        nOutBufferSize,    // size of output buffer 
                 (LPDWORD)      lpBytesReturned,   // number of bytes returned 
                 (LPOVERLAPPED) lpOverlapped );    // OVERLAPPED structure

Parameters

hDevice

A handle to a NTFS volume or a file on a NTFS volume for which stream mapping data is to be retrieved. To retrieve a handle, call the CreateFile function.

This handle must be opened with FILE_FLAG_BACKUP_SEMANTICS. For more information about access rights, see File Security and Access Rights.

dwIoControlCode

The control code for the operation. Use FSCTL_LOOKUP_STREAM_FROM_CLUSTER for this operation.

lpInBuffer

A pointer to the input buffer, a LOOKUP_STREAM_FROM_CLUSTER_INPUT structure.

nInBufferSize

The size of the input buffer, in bytes.

lpOutBuffer

A pointer to the output buffer. On successful return the buffer will contain a LOOKUP_STREAM_FROM_CLUSTER_OUTPUT structure followed by zero or more LOOKUP_STREAM_FROM_CLUSTER_ENTRY entries. The input and output buffers can be at the same location.

nOutBufferSize

The size of the output buffer, in bytes.

lpBytesReturned

A pointer to a variable that receives the size of the data stored in the output buffer, in bytes.

If the output buffer is too small, the call fails and GetLastError returns ERROR_MORE_DATA

If lpOverlapped is NULL, lpBytesReturned cannot be NULL. Even when an operation returns no output data and lpOutBuffer is NULL, DeviceIoControl uses lpBytesReturned. After such an operation, the value of lpBytesReturnedis meaningless.

If lpOverlapped is not NULL, lpBytesReturned can be NULL. If this parameter is not NULL and the operation returns data, lpBytesReturned is meaningless until the overlapped operation is complete. To retrieve the number of bytes returned, call GetOverlappedResult. If hDevice is associated with an I/O completion port, you can retrieve the number of bytes returned by calling GetQueuedCompletionStatus.

lpOverlapped

A pointer to an OVERLAPPED structure.

If hDevice is opened without specifying FILE_FLAG_OVERLAPPED, lpOverlapped is ignored.

If hDevice is opened with the FILE_FLAG_OVERLAPPEDflag, the operation is performed as an overlapped (asynchronous) operation. In this case, lpOverlapped must point to a valid OVERLAPPED structure that contains a handle to an event object. Otherwise, the function fails in unpredictable ways.

For overlapped operations, DeviceIoControl returns immediately, and the event object is signaled when the operation is complete. Otherwise, the function does not return until the operation is complete or an error occurs.

Return value

If the operation completes successfully, DeviceIoControl returns a nonzero value.

If the operation fails or is pending, DeviceIoControl returns zero. To get extended error information, call GetLastError.

The following table identifies the possible return values.

Return code/valueDescription
ERROR_INVALID_PARAMETER
87 (0x57)

One or more of the following:

  • The handle used is not a file, directory, or volume.
  • The size of the input buffer is smaller than required.
  • Another parameter is invalid.
ERROR_ACCESS_DENIED
5

The handle used was not created with sufficient access rights.

ERROR_NOT_READY
21 (0x15)

The volume is a supported file system volume and is unmounted.

ERROR_INVALID_USER_BUFFER
1884 (0x75C)

One or both of the buffers passed in were not within a valid address range.

ERROR_MORE_DATA
234 (0xEA)

The output buffer was not large enough to contain all of the requested data. The BufferSizeRequired member of the LOOKUP_STREAM_FROM_CLUSTER_OUTPUT structure in the output buffer contains the buffer size that would have been required. The caller should call again with a larger output buffer.

 

Remarks

In Windows 8 and Windows Server 2012, this code is supported by the following technologies.

TechnologySupported

Server Message Block (SMB) 3.0 protocol

No

SMB 3.0 Transparent Failover (TFO)

No

SMB 3.0 with Scale-out File Shares (SO)

No

Cluster Shared Volume File System (CsvFS)

Yes

 

Requirements

Minimum supported client

Windows 7 [desktop apps only]

Minimum supported server

Windows Server 2008 R2 [desktop apps only]

Header

WinIoCtl.h (include Windows.h)

See also

CreateFile
Defragmentation
DeviceIoControl
Disk Management Control Codes
GetLastError
GetOverlappedResult
GetQueuedCompletionStatus
OVERLAPPED
LOOKUP_STREAM_FROM_CLUSTER_INPUT
LOOKUP_STREAM_FROM_CLUSTER_OUTPUT
LOOKUP_STREAM_FROM_CLUSTER_ENTRY

 

 

Community Additions

ADD
Show:
© 2015 Microsoft