FltQueryVolumeInformationFile function (fltkernel.h)

Article
10/21/2021

FltQueryVolumeInformationFile retrieves volume information for a given file, directory, storage device, or volume.

Syntax

NTSTATUS FLTAPI FltQueryVolumeInformationFile(
  [in]            PFLT_INSTANCE        Instance,
  [in]            PFILE_OBJECT         FileObject,
  [out]           PVOID                FsInformation,
  [in]            ULONG                Length,
  [in]            FS_INFORMATION_CLASS FsInformationClass,
  [out, optional] PULONG               LengthReturned
);

Parameters

[in] Instance

Opaque instance pointer for the caller. This parameter is required and cannot be NULL.

[in] FileObject

File object pointer for an open file, directory, storage device, or volume. This parameter is required and cannot be NULL.

[out] FsInformation

Pointer to a caller-allocated buffer that receives information about the file. The FsInformationClass parameter specifies the type of information. This parameter is required and cannot be NULL.

[in] Length

Size, in bytes, of the FsInformation buffer.

[in] FsInformationClass

Type of volume information to be returned. One of the following:

Value	Meaning
FileFsAttributeInformation	Return a FILE_FS_ATTRIBUTE_INFORMATION structure that contains attribute information about the file system responsible for the volume.
FileFsControlInformation	Return a FILE_FS_CONTROL_INFORMATION structure that contains file system control information about the volume.
FileFsDeviceInformation	Return a FILE_FS_DEVICE_INFORMATION structure that contains device information for the volume.
FileFsDriverPathInformation	Return a FILE_FS_DRIVER_PATH_INFORMATION structure that contains information about whether a specified driver is in the I/O path for the volume. The caller must store the name of the driver into the FILE_FS_DRIVER_PATH_INFORMATION structure before calling FltQueryVolumeInformationFile.
FileFsFullSizeInformation	Return a FILE_FS_FULL_SIZE_INFORMATION structure that contains information about the total amount of space available on the volume.
FileFsObjectIdInformation	Return a FILE_FS_OBJECTID_INFORMATION structure that contains file-system-specific object ID information for the volume. Note that this is not the same as the (GUID-based) unique volume name that is assigned by the operating system.
FileFsSizeInformation	Return a FILE_FS_SIZE_INFORMATION structure containing information about the amount of space on the volume that is available to the user that is associated with the calling thread.
FileFsVolumeInformation	Return a FILE_FS_VOLUME_INFORMATION that contains information about the volume such as the volume label, serial number, and creation time.
FileFsSectorSizeInformation	Return a FILE_FS_SECTOR_SIZE_INFORMATION structure that contains information about the physical and logical sector sizes of a volume.

[out, optional] LengthReturned

Pointer to a caller-allocated variable that receives the size, in bytes, of the information returned in the FsInformation buffer. This parameter is optional and can be NULL.

Return value

FltQueryVolumeInformationFile returns STATUS_SUCCESS or an appropriate NTSTATUS value such as the following:

Return code	Description
STATUS_VOLUME_DISMOUNTED	The volume is not currently mounted. This is an error code.

Remarks

FltQueryVolumeInformationFile retrieves volume information for a given file, directory, storage device, or volume.

If the FileObject represents a direct device open, only FileFsDeviceInformation can be specified as the value of FsInformationClass.

FltQueryVolumeInformationFile returns zero in any member of a FILE_FS_XXX_INFORMATION structure that is not supported by a particular file system.

Requirements

Requirement	Value
Target Platform	Universal
Header	fltkernel.h (include Fltkernel.h)
Library	FltMgr.lib
DLL	Fltmgr.sys
IRQL	PASSIVE_LEVEL