FILE_STAT_BASIC_INFORMATION structure (ntifs.h)
FILE_STAT_BASIC_INFORMATION contains basic metadata about a file.
Syntax
typedef struct _FILE_STAT_BASIC_INFORMATION {
LARGE_INTEGER FileId;
LARGE_INTEGER CreationTime;
LARGE_INTEGER LastAccessTime;
LARGE_INTEGER LastWriteTime;
LARGE_INTEGER ChangeTime;
LARGE_INTEGER AllocationSize;
LARGE_INTEGER EndOfFile;
ULONG FileAttributes;
ULONG ReparseTag;
ULONG NumberOfLinks;
ULONG DeviceType;
ULONG DeviceCharacteristics;
ULONG Reserved;
LARGE_INTEGER VolumeSerialNumber;
FILE_ID_128 FileId128;
} FILE_STAT_BASIC_INFORMATION, *PFILE_STAT_BASIC_INFORMATION;
Members
FileId
Specifies the identifier of a file.
CreationTime
Specifies the creation time of a file.
LastAccessTime
Specifies the last time a file was accessed.
LastWriteTime
Specifies the last time a file was written to.
ChangeTime
Specifies the last time a file was changed.
AllocationSize
File allocation size, in bytes. Usually this value is a multiple of the sector or cluster size of the underlying physical device.
EndOfFile
The absolute new end-of-file position as a byte offset from the start of the file. EndOfFile specifies the byte offset to the end of the file. Because this value is zero-based, it actually refers to the first free byte in the file. In other words, EndOfFile is the offset to the byte immediately following the last valid byte in the file.
FileAttributes
File attributes, which can be any valid combination of the following:
| Attribute | Value |
|---|---|
| FILE_ATTRIBUTE_READONLY | 0x00000001 |
| FILE_ATTRIBUTE_HIDDEN | 0x00000002 |
| FILE_ATTRIBUTE_SYSTEM | 0x00000004 |
| FILE_ATTRIBUTE_DIRECTORY | 0x00000010 |
| FILE_ATTRIBUTE_ARCHIVE | 0x00000020 |
| FILE_ATTRIBUTE_NORMAL | 0x00000080 |
ReparseTag
Specifies the tag for a reparse point. See About reparse points for more information.
NumberOfLinks
Specifies the number of links to the file.
DeviceType
Set when a driver calls IoCreateDevice as appropriate for the type of underlying device. For more information, see Specifying Device Types.
DeviceCharacteristics
The device characteristics. For a description of relevant values, see DEVICE_OBJECT.
Reserved
Reserved for system use.
VolumeSerialNumber
Serial number of the volume where the file is located.
FileId128
The 128-byte file reference number for the file. This number is generated and assigned to the file by the file system.
Remarks
This information can be queried in either of the following ways:
Call ZwQueryDirectoryFile, passing FileStatBasicInformation as the value of FileInformationClass and passing a caller-allocated, FILE_ID_EXTD_DIR_INFORMATION-structured buffer as the value of FileInformation.
Create an IRP with major function code IRP_MJ_DIRECTORY_CONTROL and minor function code IRP_MN_QUERY_DIRECTORY.
No specific access rights are required to query this information.
File reference numbers, also called file IDs, are guaranteed to be unique only within a static file system. They are not guaranteed to be unique over time, because file systems are free to reuse them. Nor are they guaranteed to remain constant. For example, the FAT file system generates the file reference number for a file from the byte offset of the file's directory entry record (DIRENT) on the disk. Defragmentation can change this byte offset. Thus a FAT file reference number can change over time.
All dates and times are in absolute system-time format. Absolute system time is the number of 100-nanosecond intervals since the start of the year 1601.
This structure must be aligned on a LONGLONG (8-byte) boundary. If a buffer contains two or more of these structures, the NextEntryOffset value in each entry, except the last, falls on an 8-byte boundary.
Requirements
| Requirement | Value |
|---|---|
| Minimum supported client | Windows 11, version 24H2 |
| Header | ntifs.h |