FltQueryInformationFile function

FltQueryInformationFile retrieves information for a given file.

Syntax

NTSTATUS FLTAPI FltQueryInformationFile(
  PFLT_INSTANCE          Instance,
  PFILE_OBJECT           FileObject,
  PVOID                  FileInformation,
  ULONG                  Length,
  FILE_INFORMATION_CLASS FileInformationClass,
  PULONG                 LengthReturned
);

Parameters

Instance

Opaque instance pointer for the caller. This parameter is required and cannot be NULL.

FileObject

File object pointer for the file. This parameter is required and cannot be NULL.

FileInformation

Pointer to a caller-allocated buffer that receives information about the file. The FileInformationClass parameter specifies the type of information. This parameter is required and cannot be NULL.

Length

Size, in bytes, of the FileInformation buffer.

FileInformationClass

Type of file information to be returned. One of the following.

Value Meaning
FileAllInformation Return a FILE_ALL_INFORMATION structure for the file.
FileAttributeTagInformation Return a FILE_ATTRIBUTE_TAG_INFORMATION structure for the file.
FileBasicInformation Return a FILE_BASIC_INFORMATION structure for the file.
FileCompressionInformation Return a FILE_COMPRESSION_INFORMATION structure for the file.
FileEaInformation Return a FILE_EA_INFORMATION structure for the file.
FileInternalInformation Return a FILE_INTERNAL_INFORMATION structure for the file.
FileMoveClusterInformation Return a FILE_MOVE_CLUSTER_INFORMATION structure for the file.
FileNameInformation Return a FILE_NAME_INFORMATION structure for the file.
FileNetworkOpenInformation Return a single FILE_NETWORK_OPEN_INFORMATION structure for the file.
FilePositionInformation Return a single FILE_POSITION_INFORMATION structure for the file.
FileStandardInformation Return a single FILE_STANDARD_INFORMATION structure for the file.
FileStreamInformation Return a single FILE_STREAM_INFORMATION structure for the file.
FileHardLinkInformation Return a FILE_LINKS_INFORMATION structure for the file.

LengthReturned

Pointer to a caller-allocated variable that receives the size, in bytes, of the information returned in the FileInformation buffer. This parameter is optional and can be NULL.

Return Value

FltQueryInformationFile returns STATUS_SUCCESS or an appropriate NTSTATUS value such as the following:

Return code Description
STATUS_VOLUME_DISMOUNTED
The file resides on a volume that is not currently mounted. This is an error code.

Remarks

A minifilter driver calls FltQueryInformationFile to retrieve information for a given file. The file must currently be open.

FltQueryInformationFile returns zero in any member of a FILE_XXX_INFORMATION structure that is not supported by a particular file system.

Callers of FltQueryInformationFile must be running at IRQL = PASSIVE_LEVEL and with APCs enabled.

Note Before calling this routine, call IoGetTopLevelIrp. If IoGetTopLevelIrp returns a non-NULL value, do not call the routine as this can cause a system deadlock.

Requirements

   
Target Platform Universal
Header fltkernel.h (include Fltkernel.h)
Library FltMgr.lib
DLL Fltmgr.sys
IRQL PASSIVE_LEVEL (see Remarks section)

See Also

FILE_ALIGNMENT_INFORMATION

FILE_ATTRIBUTE_TAG_INFORMATION

FILE_BASIC_INFORMATION

FILE_INTERNAL_INFORMATION

FILE_LINKS_INFORMATION

FILE_NAME_INFORMATION

FILE_NETWORK_OPEN_INFORMATION

FILE_POSITION_INFORMATION

FILE_STANDARD_INFORMATION

FILE_STREAM_INFORMATION

FltQueryVolumeInformationFile

FltSetInformationFile

ZwQueryInformationFile