FltGetCopyInformationFromCallbackData function (fltkernel.h)

Article
02/22/2024

The FltGetCopyInformationFromCallbackData routine retrieves copy information from the callback data, if present. The copy information is in the IRP extension for read/write calls coming from NtCopyFileChunk.

Syntax

NTSTATUS FLTAPI FltGetCopyInformationFromCallbackData(
  [in]  PFLT_CALLBACK_DATA Data,
  [out] PCOPY_INFORMATION  CopyInformation
);

Parameters

[in] Data

Pointer to a FLT_CALLBACK_DATA structure that holds the callback data.

[out] CopyInformation

Pointer to a COPY_INFORMATION structure into which the copy information will be written.

Return value

FltGetCopyInformationFromCallbackData returns STATUS_SUCCESS upon success, or an error code such as the following.

Error code	Meaning
STATUS_INVALID_PARAMETER	The callback data is not for an IRP operation.
STATUS_NOT_FOUND	The copy information IRP extension was not set on the IRP.

Remarks

Any trusted read or write operations from NtCopyFileChunk will have the following:

The IRP's requestor mode set to KernelMode.
An IRP extension with an IopCopyInformationType type and information about the copy operation.

Filters do not have access to IRP extensions directly, but can check for the presence of the copy extension and get copy information by calling FltGetCopyInformationFromCallbackData.

See Kernel-mode file copy and detecting copy file scenarios for more information.

Requirements

Requirement	Value
Minimum supported client	Windows 11, version 22H2
Header	fltkernel.h
IRQL	<= DISPATCH_LEVEL