FSCTL_LOOKUP_STREAM_FROM_CLUSTER IOCTL (winioctl.h)
Given a handle to a NTFS volume or a file on a NTFS volume, returns a chain of data structures that describes streams that occupy the specified clusters.
FSCTL_LOOKUP_STREAM_FROM_CLUSTER is a very resource-intensive operation, and typically uses a very large amount of disk bandwidth, memory, and time. It is unlikely that much of this information will remain in cache so a second call to FSCTL_LOOKUP_STREAM_FROM_CLUSTER would take nearly as much time as the first call. For doing multiple lookups it's more efficient to use FSCTL_ENUM_USN_DATA to enumerate every MFT record and then use FSCTL_GET_RETRIEVAL_POINTERS to gather the data to map between clusters and streams.
To perform this operation, call the DeviceIoControl function with the following parameters.
BOOL DeviceIoControl( (HANDLE) hDevice, // handle to file, directory, or volume FSCTL_LOOKUP_STREAM_FROM_CLUSTER, // dwIoControlCode (LPVOID) lpInBuffer, // input buffer (DWORD) nInBufferSize, // size of input buffer (LPVOID) lpOutBuffer, // output buffer (DWORD) nOutBufferSize, // size of output buffer (LPDWORD) lpBytesReturned, // number of bytes returned (LPOVERLAPPED) lpOverlapped // OVERLAPPED structure );
In Windows 8 and Windows Server 2012, this code is supported by the following technologies.
|Server Message Block (SMB) 3.0 protocol||No|
|SMB 3.0 Transparent Failover (TFO)||No|
|SMB 3.0 with Scale-out File Shares (SO)||No|
|Cluster Shared Volume File System (CsvFS)||Yes|
|Minimum supported client||Windows 7 [desktop apps only]|
|Minimum supported server||Windows Server 2008 R2 [desktop apps only]|
|Header||winioctl.h (include Windows.h)|