FltRetrieveFileInfoOnCreateCompletion function (fltkernel.h)

Article
10/21/2021

FltRetrieveFileInfoOnCreateCompletion retrieves the requested file information during file post create. Use FltRetrieveFileInfoOnCreateCompletionEx to get an NTSTATUS code along with the requested information.

Syntax

PVOID FLTAPI FltRetrieveFileInfoOnCreateCompletion(
  [in]  PFLT_FILTER        Filter,
  [in]  PFLT_CALLBACK_DATA Data,
  [in]  ULONG              InfoClass,
  [out] PULONG             Size
);

Parameters

[in] Filter

Opaque filter pointer that uniquely identifies the minifilter driver.

[in] Data

Pointer to the FLT_CALLBACK_DATA callback data representing the I/O operation.

[in] InfoClass

Flag that indicates the type of information to return. Note that flags cannot be combined. Can be one of the following values:

Flag	Meaning
QoCFileStatInformation (0x00000001)	The file system will return file stat information in a QUERY_ON_CREATE_FILE_STAT_INFORMATION structure.
QoCFileLxInformation (0x00000002)	The file system will return extended Linux-like information in a QUERY_ON_CREATE_FILE_LX_INFORMATION structure.
QoCFileEaInformation (0x00000004)	The file system will return extended attributes (EA) in a QUERY_ON_CREATE_EA_INFORMATION structure.

[out] Size

Pointer to a ULONG that specifies the size, in bytes, of the buffer that this function returns.

Return value

FltRetrieveFileInfoOnCreateCompletion returns a pointer to a buffer with the requested file information. The structure within the buffer is determined by the value of InfoClass. If the file system processes the request but can't find the requested file information, this parameter is set to NULL.

Remarks

A minifilter must call FltRequestFileInfoOnCreateCompletion during file pre-create to specify which file information the file system should track.

Requirements

Requirement	Value
Header	fltkernel.h