FltGetCopyInformationFromCallbackData function (fltkernel.h)
The FltGetCopyInformationFromCallbackData routine retrieves copy information from the callback data, if present. The copy information is in the IRP extension for read/write calls coming from NtCopyFileChunk.
Syntax
NTSTATUS FLTAPI FltGetCopyInformationFromCallbackData(
[in] PFLT_CALLBACK_DATA Data,
[out] PCOPY_INFORMATION CopyInformation
);
Parameters
[in] Data
Pointer to a FLT_CALLBACK_DATA structure that holds the callback data.
[out] CopyInformation
Pointer to a COPY_INFORMATION structure into which the copy information will be written.
Return value
FltGetCopyInformationFromCallbackData returns STATUS_SUCCESS upon success, or an error code such as the following.
| Error code | Meaning |
|---|---|
| STATUS_INVALID_PARAMETER | The callback data is not for an IRP operation. |
| STATUS_NOT_FOUND | The copy information IRP extension was not set on the IRP. |
Remarks
Any trusted read or write operations from NtCopyFileChunk will have the following:
- The IRP's requestor mode set to KernelMode.
- An IRP extension with an IopCopyInformationType type and information about the copy operation.
Filters do not have access to IRP extensions directly, but can check for the presence of the copy extension and get copy information by calling FltGetCopyInformationFromCallbackData.
See Kernel-mode file copy and detecting copy file scenarios for more information.
Requirements
| Requirement | Value |
|---|---|
| Minimum supported client | Windows 11, version 22H2 |
| Header | fltkernel.h |
| IRQL | <= DISPATCH_LEVEL |
See also
IoCheckFileObjectOpenedAsCopyDestination