The topic you requested is included in another documentation set. For convenience, it's displayed below. Choose Switch to see the topic in its original location.

FSCTL_MARK_HANDLE control code

Marks a specified file or directory and its change journal record with information about changes to that file or directory.

To perform this operation, call the DeviceIoControl function using the following parameters.

DeviceIoControl( (HANDLE) hDevice,              // handle to file or directory
                 FSCTL_MARK_HANDLE,             // dwIoControlCode
                 (LPVOID)lpInBuffer,            // input buffer
                 (DWORD)nInBufferSize,          // size of input buffer
                 NULL,                          // lpOutBuffer
                 0,                             // nOutBufferSize
                 (LPDWORD) lpBytesReturned,     // number of bytes returned
                 (LPOVERLAPPED) lpOverlapped ); // OVERLAPPED structure



A handle to the file or directory whose handle is to be marked. To retrieve a file or directory handle, call the CreateFile function. FSCTL_MARK_HANDLE only operates on files or directories.


The control code for the operation. Use FSCTL_MARK_HANDLE for this operation.


A pointer to the input buffer, a MARK_HANDLE_INFO structure.


The size of the input buffer, in bytes.


Not used with this operation; set to NULL.


Not used with this operation; set to zero.


A pointer to a variable that receives the size of the data stored in the output buffer, in bytes.

If lpOverlapped is NULL, lpBytesReturned cannot be NULL. Even when an operation returns no output data and lpOutBuffer is NULL, DeviceIoControl makes use of lpBytesReturned. After such an operation, the value of lpBytesReturned is meaningless.

If lpOverlapped is not NULL, lpBytesReturned can be NULL. If this parameter is not NULL and the operation returns data, lpBytesReturned is meaningless until the overlapped operation has completed. To retrieve the number of bytes returned, call GetOverlappedResult. If hDevice is associated with an I/O completion port, you can retrieve the number of bytes returned by calling GetQueuedCompletionStatus.


A pointer to an OVERLAPPED structure.

If hDevice was opened without specifying FILE_FLAG_OVERLAPPED, lpOverlapped is ignored.

If hDevice was opened with the FILE_FLAG_OVERLAPPED flag, the operation is performed as an overlapped (asynchronous) operation. In this case, lpOverlapped must point to a valid OVERLAPPED structure that contains a handle to an event object. Otherwise, the function fails in unpredictable ways.

For overlapped operations, DeviceIoControl returns immediately, and the event object is signaled when the operation has been completed. Otherwise, the function does not return until the operation has been completed or an error occurs.

Return value

If the operation completes successfully, DeviceIoControl returns a nonzero value.

If the operation fails or is pending, DeviceIoControl returns zero. To get extended error information, call GetLastError.

Possible return values include the following.

Return codeDescription

The volume containing the specified file or directory does not support change journals. Where supported, change journals can also be deleted.


One or more parameters was invalid. For example, DeviceIoControl returns this error code if the handle supplied is not a file or directory handle.



For the implications of overlapped I/O on this operation, see the Remarks section of the DeviceIoControl topic.

FSCTL_MARK_HANDLE is the only change journal operation that operates on an individual file or directory. It does not affect anything the user can do with the item. Instead, it adds information to the file or directory, either providing information on how the operating system changed the item or adding a private data stream to the item.

If there are any changes to the file or directory, then the information added with FSCTL_MARK_HANDLE is also copied into the USN record created for the file or directory. Note that these two operations can occur independently of each other—for example, it is not necessary for a USN record to exist to be able to mark a file as unable to be defragmented (see the reference page for MARK_HANDLE_INFO for more information on this) and it is not necessary to mark a file or directory to update the contents of the corresponding USN record. For details on the information with which FSCTL_MARK_HANDLE can mark an item, see the reference page for MARK_HANDLE_INFO.

It is not an error to use FSCTL_MARK_HANDLE while the volume's change journal is being deleted or is inactive. The appropriate information is applied to the file or directory regardless of the state of the change journal, as long as the change journal exists.

Note that the time stamps may not be updated correctly for a remote file. To ensure consistent results, use unbuffered I/O.

The volume must be NTFS.

In Windows 8 and Windows Server 2012, this code is supported by the following technologies.


Server Message Block (SMB) 3.0 protocol


SMB 3.0 Transparent Failover (TFO)


SMB 3.0 with Scale-out File Shares (SO)


Cluster Shared Volume File System (CsvFS)



CsvFs always issues USN_SOURCE_REPLICATION_MANAGEMENT and MARK_HANDLE_PROTECT_CLUSTERS for the files eligible for direct IO.


Minimum supported client

Windows XP [desktop apps only]

Minimum supported server

Windows Server 2003 [desktop apps only]


WinIoCtl.h (include Windows.h)

See also

Change Journals
Volume Management Control Codes