File Objects

File objects function as the logical interface between kernel and user-mode processes and the file data that resides on the physical disk. A file object contains both the data written to the file and the following set of kernel-maintained attributes.

Information type	Purpose
File name	Names the corresponding physical file.
Current byte offset	Used in synchronous file I/O (described later in this section) to identify the current starting location of read and write operations.
Share mode	Specifies whether a second process can open a file for read, write, or delete access while the initial process is still accessing it.
I/O mode	Specifies whether the initial process opened the file for synchronous or asynchronous I/O, cached or uncached I/O, sequential or random I/O, and so on.
Pointer to device object	Identifies the physical device the file data resides on.
Pointer to the volume parameter block, or VPB	Identifies the volume or partition the file data resides on.
Pointer to section object pointers	Identifies a root structure that describes a mapped file.
Pointer to private cache map	Identifies the file data that is currently cached.

 

These attributes are defined as part of the FILE_OBJECT structure in Ntddk.h. Refer to the definition of this structure in the Windows Driver Kit (WDK) documentation for the data lengths and types of the values.