Edit

FltQueryEaFile function (fltkernel.h)

  • Article

FltQueryEaFile returns information about extended-attribute (EA) values for a file.

Syntax

NTSTATUS FLTAPI FltQueryEaFile(
  [in]            PFLT_INSTANCE Instance,
  [in]            PFILE_OBJECT  FileObject,
  [out]           PVOID         ReturnedEaData,
  [in]            ULONG         Length,
  [in]            BOOLEAN       ReturnSingleEntry,
  [in, optional]  PVOID         EaList,
  [in]            ULONG         EaListLength,
  [in, optional]  PULONG        EaIndex,
  [in]            BOOLEAN       RestartScan,
  [out, optional] PULONG        LengthReturned
);

Parameters

[in] Instance

Opaque instance pointer for the minifilter driver instance that the QueryEa operation is to be sent to. The instance must be attached to the volume where the file resides.

[in] FileObject

File object pointer for the file.

[out] ReturnedEaData

Pointer to a caller-supplied FILE_FULL_EA_INFORMATION-structured input buffer where the extended attribute values are to be returned.

[in] Length

Length, in bytes, of the buffer that the ReturnedEaData parameter points to.

[in] ReturnSingleEntry

Set to TRUE if FltQueryEaFile should return only the first entry that is found.

[in, optional] EaList

Pointer to a caller-supplied FILE_GET_EA_INFORMATION-structured input buffer specifying the extended attributes to be queried. This parameter is optional and can be NULL.

[in] EaListLength

Length, in bytes, of the buffer that the EaList parameter points to.

[in, optional] EaIndex

Index of the entry at which to begin scanning the file's extended-attribute list. This parameter is ignored if the EaList parameter points to a nonempty list. This parameter is optional and can be NULL.

[in] RestartScan

Set to TRUE if FltQueryEaFile should begin the scan at the first entry in the file's extended-attribute list. If this parameter is not set to TRUE, the scan is resumed from a previous call to FltQueryEaFile.

[out, optional] LengthReturned

Pointer to a caller-allocated variable that receives the size, in bytes, of the information returned in the ReturnedEaData buffer. This parameter is optional and can be NULL.

Return value

FltQueryEaFile returns STATUS_SUCCESS or an appropriate NTSTATUS value such as the following:

Return code Description
STATUS_EAS_NOT_SUPPORTED
 The file system does not support extended attributes. This is an error code.
STATUS_FLT_DELETING_OBJECT
 The instance or volume is being torn down. This is an error code.
STATUS_INSUFFICIENT_RESOURCES
 FltQueryEaFile encountered a pool allocation failure. This is an error code.

Requirements

Requirement Value
Minimum supported client Available in Microsoft Windows 2000 Update Rollup 1 for SP4, Windows XP SP3, Windows Server 2003 SP1, and later versions of the Windows operating system.
Target Platform Universal
Header fltkernel.h (include Fltkernel.h)
Library FltMgr.lib
DLL Fltmgr.sys
IRQL PASSIVE_LEVEL

See also

FILE_FULL_EA_INFORMATION

FILE_GET_EA_INFORMATION

FltSetEaFile

IoCheckEaBufferValidity