FILE_NOTIFY_EXTENDED_INFORMATION structure (ntifs.h)
FILE_NOTIFY_EXTENDED_INFORMATION provides information about a directory change in response to an IRP_MJ_DIRECTORY_CONTROL request with an IRP_MN_NOTIFY_CHANGE_DIRECTORY minor function code when DIRECTORY_NOTIFY_INFORMATION_CLASS is DirectoryNotifyExtendedInformation.
Syntax
typedef struct _FILE_NOTIFY_EXTENDED_INFORMATION {
ULONG NextEntryOffset;
ULONG Action;
LARGE_INTEGER CreationTime;
LARGE_INTEGER LastModificationTime;
LARGE_INTEGER LastChangeTime;
LARGE_INTEGER LastAccessTime;
LARGE_INTEGER AllocatedLength;
LARGE_INTEGER FileSize;
ULONG FileAttributes;
union {
ULONG ReparsePointTag;
ULONG EaSize;
} DUMMYUNIONNAME;
LARGE_INTEGER FileId;
LARGE_INTEGER ParentFileId;
ULONG FileNameLength;
WCHAR FileName[1];
} FILE_NOTIFY_EXTENDED_INFORMATION, *PFILE_NOTIFY_EXTENDED_INFORMATION;
Members
NextEntryOffset
The number of bytes that must be skipped to get to the next record. A value of zero indicates that this is the last record.
Action
The type of change that has occurred. This member can be one of the following values.
| Value | Meaning |
|---|---|
| FILE_ACTION_ADDED (0x00000001) | A file was added to the directory. |
| FILE_ACTION_REMOVED (0x00000002) | A file was removed from the directory. |
| FILE_ACTION_MODIFIED (0x00000003) | The directory was modified. This can be a change in the time stamp or attributes. |
| FILE_ACTION_RENAMED_OLD_NAME (0x00000004) | The directory was renamed and this is the old name. |
| FILE_ACTION_RENAMED_NEW_NAME (0x00000005) | The directory was renamed and this is the new name. |
CreationTime
The date and time when the directory or file was created and added to the file system.
LastModificationTime
The date and time that the content of the directory or file was last modified in the file system.
LastChangeTime
The date and time that the metadata or content of the directory or file was last changed in the file system.
LastAccessTime
The date and time the directory or file was last accessed in the file system.
AllocatedLength
The allocated size of the file, in bytes.
FileSize
The new size of the directory or file in bytes, or the old size if the size is unchanged.
FileAttributes
File attributes, which can be any valid combination of the following:
- FILE_ATTRIBUTE_READONLY
- FILE_ATTRIBUTE_HIDDEN
- FILE_ATTRIBUTE_SYSTEM
- FILE_ATTRIBUTE_DIRECTORY
- FILE_ATTRIBUTE_ARCHIVE
- FILE_ATTRIBUTE_NORMAL
- FILE_ATTRIBUTE_TEMPORARY
- FILE_ATTRIBUTE_COMPRESSED
DUMMYUNIONNAME
DUMMYUNIONNAME.ReparsePointTag
The identifier tag of a reparse point for the directory or file.
DUMMYUNIONNAME.EaSize
Combined length of the extended attributes (EA) for the file, in bytes.
FileId
The identifier of the directory or file. This number is generated and assigned to the file by the file system.
ParentFileId
The identifier of the parent directory of the file.
FileNameLength
The size of the file name portion of the record, in bytes. This value does not include a terminating null character.
FileName[1]
A variable-length field that contains the file name relative to the directory handle. The file name is in the Unicode character format and is not null-terminated.
Requirements
| Requirement | Value |
|---|---|
| Header | ntifs.h |