Edit

Share via

FltQueryInformationFile function (fltkernel.h)

  • Article

FltQueryInformationFile retrieves information for a given file.

Syntax

NTSTATUS FLTAPI FltQueryInformationFile(
  [in]            PFLT_INSTANCE          Instance,
  [in]            PFILE_OBJECT           FileObject,
  [out]           PVOID                  FileInformation,
  [in]            ULONG                  Length,
  [in]            FILE_INFORMATION_CLASS FileInformationClass,
  [out, optional] PULONG                 LengthReturned
);

Parameters

[in] Instance

Opaque instance pointer for the caller. This parameter is required and cannot be NULL.

[in] FileObject

File object pointer for the file. This parameter is required and cannot be NULL.

[out] FileInformation

Pointer to a caller-allocated buffer that receives information about the file. The FileInformationClass parameter specifies the type of information. This parameter is required and cannot be NULL.

[in] Length

Size, in bytes, of the FileInformation buffer.

[in] FileInformationClass

A FILE_INFORMATION_CLASS value that specifies the type of file information to be returned in the FileInformation buffer.

[out, optional] LengthReturned

Pointer to a caller-allocated variable that receives the size, in bytes, of the information returned in the FileInformation buffer. This parameter is optional and can be NULL.

Return value

FltQueryInformationFile returns STATUS_SUCCESS or an appropriate NTSTATUS value such as the following:

Return code Description
STATUS_VOLUME_DISMOUNTED
 The file resides on a volume that is not currently mounted. This is an error code.

Remarks

A minifilter driver calls FltQueryInformationFile to retrieve information for the file identified by FileObject. The file must currently be open.

FltQueryInformationFile returns zero in any member of a FILE_XXX_INFORMATION structure that is not supported by a particular file system.

Callers of FltQueryInformationFile must be running at IRQL = PASSIVE_LEVEL and with APCs enabled.

NOTE: Do not call this routine with a non-NULL top level IRP value, as this can cause a system deadlock.

Requirements

Requirement Value
Target Platform Universal
Header fltkernel.h (include Fltkernel.h)
Library FltMgr.lib
DLL Fltmgr.sys
IRQL PASSIVE_LEVEL (see Remarks section)

See also

FILE_INFORMATION_CLASS

FltQueryVolumeInformationFile

FltSetInformationFile

ZwQueryInformationFile