2.7.1 FILE_NOTIFY_INFORMATION

  • Article

The FILE_NOTIFY_INFORMATION structure contains the changes for which the client is being notified. The structure consists of the following.


0


1


2


3


4


5


6


7


8


9

1
0


1


2


3


4


5


6


7


8


9

2
0


1


2


3


4


5


6


7


8


9

3
0


1

NextEntryOffset

Action

FileNameLength

FileName (variable)

NextEntryOffset (4 bytes): The offset, in bytes, from the beginning of this structure to the subsequent FILE_NOTIFY_INFORMATION structure. If there are no subsequent structures, the NextEntryOffset field MUST be 0. NextEntryOffset MUST always be an integral multiple of 4. The FileName array MUST be padded to the next 4-byte boundary counted from the beginning of the structure.

Action (4 bytes): The changes that occurred on the file. This field MUST contain one of the following values.<169>

Value

Meaning

FILE_ACTION_ADDED

0x00000001

The file was renamed, and FileName contains the new name. This notification is only sent when the rename operation changes the directory the file resides in. The client will also receive a FILE_ACTION_REMOVED notification. This notification will not be received if the file is renamed within a directory.

FILE_ACTION_REMOVED

0x00000002

The file was renamed, and FileName contains the old name. This notification is only sent when the rename operation changes the directory the file resides in. The client will also receive a FILE_ACTION_ADDED notification. This notification will not be received if the file is renamed within a directory.

FILE_ACTION_MODIFIED

0x00000003

The file was modified. This can be a change to the data or attributes of the file.

FILE_ACTION_RENAMED_OLD_NAME

0x00000004

The file was renamed, and FileName contains the old name. This notification is only sent when the rename operation does not change the directory the file resides in. The client will also receive a FILE_ACTION_RENAMED_NEW_NAME notification. This notification will not be received if the file is renamed to a different directory.

FILE_ACTION_RENAMED_NEW_NAME

0x00000005

The file was renamed, and FileName contains the new name. This notification is only sent when the rename operation does not change the directory the file resides in. The client will also receive a FILE_ACTION_RENAMED_OLD_NAME notification. This notification will not be received if the file is renamed to a different directory.

FILE_ACTION_ADDED_STREAM

0x00000006

The file was added to a named stream.

FILE_ACTION_REMOVED_STREAM

0x00000007

The file was removed from the named stream.

FILE_ACTION_MODIFIED_STREAM

0x00000008

The file was modified. This can be a change to the data or attributes of the file.

FILE_ACTION_REMOVED_BY_DELETE

0x00000009

An object ID was removed because the file the object ID referred to was deleted.

This notification is only sent when the directory being monitored is the special directory "\$Extend\$ObjId:$O:$INDEX_ALLOCATION".

FILE_ACTION_ID_NOT_TUNNELLED

0x0000000A

An attempt to tunnel object ID information to a file being created or renamed failed because the object ID is in use by another file on the same volume.

This notification is only sent when the directory being monitored is the special directory "\$Extend\$ObjId:$O:$INDEX_ALLOCATION".

FILE_ACTION_TUNNELLED_ID_COLLISION

0x0000000B

An attempt to tunnel object ID information to a file being renamed failed because the file already has an object ID.

This notification is only sent when the directory being monitored is the special directory "\$Extend\$ObjId:$O:$INDEX_ALLOCATION".

If two or more files have been renamed, the corresponding FILE_NOTIFY_INFORMATION entries for each file rename MUST be consecutive in this response for the client to make the correct correspondence between old and new names.

FileNameLength (4 bytes): The length, in bytes, of the file name in the FileName field.

FileName (variable): A Unicode string with the name of the file that changed.