ZwQueryVolumeInformationFile function (ntddk.h)

Article
01/13/2023

The ZwQueryVolumeInformationFile routine retrieves information about the volume associated with a given file, directory, storage device, or volume.

Syntax

NTSYSAPI NTSTATUS ZwQueryVolumeInformationFile(
  [in]  HANDLE               FileHandle,
  [out] PIO_STATUS_BLOCK     IoStatusBlock,
  [out] PVOID                FsInformation,
  [in]  ULONG                Length,
  [in]  FS_INFORMATION_CLASS FsInformationClass
);

Parameters

[in] FileHandle

A handle to a file object returned by ZwCreateFile or ZwOpenFile for an open file, directory, storage device, or volume for which volume information is being requested.

[out] IoStatusBlock

A pointer to an IO_STATUS_BLOCK structure that receives the final completion status and information about the query operation. For successful calls that return data, the number of bytes written to the FsInformation buffer is returned in the structure's Information member.

[out] FsInformation

A pointer to a caller-allocated buffer that receives the desired information about the volume. The structure of the information returned in the buffer is defined by the FsInformationClass parameter.

[in] Length

Size in bytes of the buffer pointed to by FsInformation. The caller should set this parameter according to the given FsInformationClass.

[in] FsInformationClass

Type of information to be returned about the volume. Set this member to one of the following FS_INFORMATION_CLASS enumeration values.

Value	Meaning
FileFsAttributeInformation	Return a FILE_FS_ATTRIBUTE_INFORMATION structure containing attribute information about the file system responsible for the volume.
FileFsControlInformation	Return a FILE_FS_CONTROL_INFORMATION structure containing file system control information about the volume.
FileFsDeviceInformation	Return a FILE_FS_DEVICE_INFORMATION structure containing device information for the volume.
FileFsDriverPathInformation	Return a FILE_FS_DRIVER_PATH_INFORMATION structure containing information about whether a specified driver is in the I/O path for the volume. The caller must store the name of the driver into the FILE_FS_DRIVER_PATH_INFORMATION structure before calling ZwQueryVolumeInformationFile.
FileFsFullSizeInformation	Return a FILE_FS_FULL_SIZE_INFORMATION structure containing information about the total amount of space available on the volume.
FileFsObjectIdInformation	Return a FILE_FS_OBJECTID_INFORMATION structure containing file system-specific object ID information for the volume. Note that this is not the same as the (GUID-based) unique volume name assigned by the operating system.
FileFsSizeInformation	Return a FILE_FS_SIZE_INFORMATION structure containing information about the amount of space on the volume that is available to the user associated with the calling thread.
FileFsVolumeInformation	Return a FILE_FS_VOLUME_INFORMATION containing information about the volume such as the volume label, serial number, and creation time.
FileFsSectorSizeInformation	Return a FILE_FS_SECTOR_SIZE_INFORMATION structure that contains information about the physical and logical sector sizes of a volume.

Return value

ZwQueryVolumeInformationFile returns STATUS_SUCCESS or an appropriate error status.

Remarks

ZwQueryVolumeInformationFile retrieves information about the volume associated with a given file, directory, storage device, or volume.

If the FileHandle represents a direct device open, only FileFsDeviceInformation can be specified as the value of FsInformationClass.

ZwQueryVolumeInformationFile returns zero in any member of a FILE_XXX_INFORMATION structure that is not supported by the file system.

For information about other file information query routines, see File Objects.

Minifilters should use FltQueryVolumeInformationFile instead of ZwQueryVolumeInformationFile.

Callers of ZwQueryVolumeInformationFile must be running at IRQL = PASSIVE_LEVEL and with special kernel APCs enabled.

If the call to the ZwQueryVolumeInformationFile function occurs in user mode, you should use the name "NtQueryVolumeInformationFile" instead of "ZwQueryVolumeInformationFile".

For calls from kernel-mode drivers, the NtXxx and ZwXxx versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters. For more information about the relationship between the NtXxx and ZwXxx versions of a routine, see Using Nt and Zw Versions of the Native System Services Routines.

Requirements

Requirement	Value
Target Platform	Universal
Header	ntddk.h (include Ntifs.h, Ntddk.h)
Library	NtosKrnl.lib
DLL	NtosKrnl.exe
IRQL	PASSIVE_LEVEL (see Remarks section)
DDI compliance rules	HwStorPortProhibitedDDIs(storport), PowerIrpDDis(wdm)