ZwQueryVolumeInformationFile function (ntifs.h)
The ZwQueryVolumeInformationFile routine retrieves information about the volume associated with a given file, directory, storage device, or volume.
Syntax
NTSYSAPI NTSTATUS ZwQueryVolumeInformationFile(
[in] HANDLE FileHandle,
[out] PIO_STATUS_BLOCK IoStatusBlock,
[out] PVOID FsInformation,
[in] ULONG Length,
[in] FS_INFORMATION_CLASS FsInformationClass
);
Parameters
[in] FileHandle
A handle to a file object returned by ZwCreateFile or ZwOpenFile for an open file, directory, storage device, or volume for which volume information is being requested.
[out] IoStatusBlock
A pointer to an IO_STATUS_BLOCK structure that receives the final completion status and information about the query operation. For successful calls that return data, the number of bytes written to the FsInformation buffer is returned in the structure's Information member.
[out] FsInformation
A pointer to a caller-allocated buffer that receives the desired information about the volume. The structure of the information returned in the buffer is defined by the FsInformationClass parameter.
[in] Length
Size in bytes of the buffer pointed to by FsInformation. The caller should set this parameter according to the given FsInformationClass.
[in] FsInformationClass
Type of information to be returned about the volume. Set this member to one of the following FS_INFORMATION_CLASS enumeration values.
| Value | Meaning |
|---|---|
| FileFsAttributeInformation | Return a FILE_FS_ATTRIBUTE_INFORMATION structure containing attribute information about the file system responsible for the volume. |
| FileFsControlInformation | Return a FILE_FS_CONTROL_INFORMATION structure containing file system control information about the volume. |
| FileFsDeviceInformation | Return a FILE_FS_DEVICE_INFORMATION structure containing device information for the volume. |
| FileFsDriverPathInformation | Return a FILE_FS_DRIVER_PATH_INFORMATION structure containing information about whether a specified driver is in the I/O path for the volume. The caller must store the name of the driver into the FILE_FS_DRIVER_PATH_INFORMATION structure before calling ZwQueryVolumeInformationFile. |
| FileFsFullSizeInformation | Return a FILE_FS_FULL_SIZE_INFORMATION structure containing information about the total amount of space available on the volume. |
| FileFsObjectIdInformation | Return a FILE_FS_OBJECTID_INFORMATION structure containing file system-specific object ID information for the volume. Note that this is not the same as the (GUID-based) unique volume name assigned by the operating system. |
| FileFsSizeInformation | Return a FILE_FS_SIZE_INFORMATION structure containing information about the amount of space on the volume that is available to the user associated with the calling thread. |
| FileFsVolumeInformation | Return a FILE_FS_VOLUME_INFORMATION containing information about the volume such as the volume label, serial number, and creation time. |
| FileFsSectorSizeInformation | Return a FILE_FS_SECTOR_SIZE_INFORMATION structure that contains information about the physical and logical sector sizes of a volume. |
Return value
ZwQueryVolumeInformationFile returns STATUS_SUCCESS or an appropriate error status.
Remarks
ZwQueryVolumeInformationFile retrieves information about the volume associated with a given file, directory, storage device, or volume.
If the FileHandle represents a direct device open, only FileFsDeviceInformation can be specified as the value of FsInformationClass.
ZwQueryVolumeInformationFile returns zero in any member of a FILE_XXX_INFORMATION structure that is not supported by the file system.
For information about other file information query routines, see File Objects.
Minifilters should use FltQueryVolumeInformationFile instead of ZwQueryVolumeInformationFile.
Callers of ZwQueryVolumeInformationFile must be running at IRQL = PASSIVE_LEVEL and with special kernel APCs enabled.
Note
If the call to the ZwQueryVolumeInformationFile function occurs in user mode, you should use the name "NtQueryVolumeInformationFile" instead of "ZwQueryVolumeInformationFile".
For calls from kernel-mode drivers, the NtXxx and ZwXxx versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters. For more information about the relationship between the NtXxx and ZwXxx versions of a routine, see Using Nt and Zw Versions of the Native System Services Routines.
Requirements
| Requirement | Value |
|---|---|
| Minimum supported client | Windows XP |
| Target Platform | Universal |
| Header | ntifs.h (include Ntifs.h, Ntddk.h) |
| Library | NtosKrnl.lib |
| DLL | NtosKrnl.exe |
| IRQL | PASSIVE_LEVEL (see Remarks section) |
| DDI compliance rules | HwStorPortProhibitedDDIs(storport), PowerIrpDDis(wdm) |
See also
FILE_FS_DRIVER_PATH_INFORMATION
IRP_MJ_QUERY_VOLUME_INFORMATION
Using Nt and Zw Versions of the Native System Services Routines