FltQueryInformationFile function (fltkernel.h)
FltQueryInformationFile retrieves information for a given file.
NTSTATUS FLTAPI FltQueryInformationFile( [in] PFLT_INSTANCE Instance, [in] PFILE_OBJECT FileObject, [out] PVOID FileInformation, [in] ULONG Length, [in] FILE_INFORMATION_CLASS FileInformationClass, [out, optional] PULONG LengthReturned );
Opaque instance pointer for the caller. This parameter is required and cannot be NULL.
File object pointer for the file. This parameter is required and cannot be NULL.
Pointer to a caller-allocated buffer that receives information about the file. The FileInformationClass parameter specifies the type of information. This parameter is required and cannot be NULL.
Size, in bytes, of the FileInformation buffer.
A FILE_INFORMATION_CLASS value that specifies the type of file information to be returned in the FileInformation buffer.
[out, optional] LengthReturned
Pointer to a caller-allocated variable that receives the size, in bytes, of the information returned in the FileInformation buffer. This parameter is optional and can be NULL.
FltQueryInformationFile returns STATUS_SUCCESS or an appropriate NTSTATUS value such as the following:
||The file resides on a volume that is not currently mounted. This is an error code.|
A minifilter driver calls FltQueryInformationFile to retrieve information for the file identified by FileObject. The file must currently be open.
FltQueryInformationFile returns zero in any member of a FILE_XXX_INFORMATION structure that is not supported by a particular file system.
Callers of FltQueryInformationFile must be running at IRQL = PASSIVE_LEVEL and with APCs enabled.
NOTE: Do not call this routine with a non-NULL top level IRP value, as this can cause a system deadlock.
|Header||fltkernel.h (include Fltkernel.h)|
|IRQL||PASSIVE_LEVEL (see Remarks section)|