LOOKUP_STREAM_FROM_CLUSTER_ENTRY structure (winioctl.h)
Returned from the FSCTL_LOOKUP_STREAM_FROM_CLUSTER control code. Zero or more of these structures follow the LOOKUP_STREAM_FROM_CLUSTER_OUTPUT structure in the output buffer returned.
Syntax
typedef struct _LOOKUP_STREAM_FROM_CLUSTER_ENTRY {
DWORD OffsetToNext;
DWORD Flags;
LARGE_INTEGER Reserved;
LARGE_INTEGER Cluster;
WCHAR FileName[1];
} LOOKUP_STREAM_FROM_CLUSTER_ENTRY, *PLOOKUP_STREAM_FROM_CLUSTER_ENTRY;
Members
OffsetToNext
Offset in bytes from the beginning of this structure to the next LOOKUP_STREAM_FROM_CLUSTER_ENTRY structure returned. If there are no more entries, this value is zero.
Flags
Flags describing characteristics about this stream. The value will consist of one or more of these values. At least one of the LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_* values that fall within the LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_MASK (0xff000000) will be set; one or more of the other flag values may be set.
Reserved
This value is reserved and is currently zero.
Cluster
This is the cluster that this entry refers to. It will be one of the clusters passed in the input structure.
FileName[1]
A NULL-terminated Unicode string containing the path of the object relative to the root of the volume. This string will refer to the attribute or stream represented by the cluster. This string is not limited by MAX_PATH and may be up to 32,768 characters (65,536 bytes) in length. Not all of the filenames returned can be opened; some are internal to NTFS and always opened exclusively. The string returned includes the full path including filename, stream name, and attribute type name in the form "full\path\to\file\filename.ext:streamname:typename".
Remarks
The name in the FileName member can be very long and in a format not recognized by a customer with the stream name and attribute type name following the filename. While it's appropriate to log the entire filename for diagnostic purposes, if it is to be presented to an end-user it should be reformatted to be more understandable (for example, remove the attribute type name and if the Flags member has any flag other than LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_DATA set then an appropriate message should be displayed.
Requirements
Requirement | Value |
---|---|
Minimum supported client | Windows 7 [desktop apps only] |
Minimum supported server | Windows Server 2008 R2 [desktop apps only] |
Header | winioctl.h (include Windows.h) |
See also
FSCTL_LOOKUP_STREAM_FROM_CLUSTER