Edit

FILE_FS_VOLUME_INFORMATION structure (ntddk.h)

  • Article

The FILE_FS_VOLUME_INFORMATION structure is used to query information about a volume on which a file system is mounted.

Syntax

typedef struct _FILE_FS_VOLUME_INFORMATION {
  LARGE_INTEGER VolumeCreationTime;
  ULONG         VolumeSerialNumber;
  ULONG         VolumeLabelLength;
  BOOLEAN       SupportsObjects;
  WCHAR         VolumeLabel[1];
} FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION;

Members

VolumeCreationTime

Time when the volume was created.

VolumeSerialNumber

Serial number of the volume.

VolumeLabelLength

Length, in bytes, of the name of the volume.

SupportsObjects

TRUE if the file system supports object-oriented file system objects, FALSE otherwise.

VolumeLabel[1]

Name of the volume.

Remarks

This information can be queried in either of the following ways:

  • Call FltQueryVolumeInformation or ZwQueryVolumeInformationFile, passing FileFsVolumeInformation as the value of FileInformationClass and passing a caller-allocated, FILE_FS_VOLUME_INFORMATION-structured buffer as the value of FileInformation.
  • Create an IRP with major function code IRP_MJ_QUERY_VOLUME_INFORMATION.
No specific access rights are required to query this information. Thus this information is available as long as the volume is accessed through an open handle to the volume itself, or to a file or directory on the volume.

All dates and times are in absolute system-time format. Absolute system time is the number of 100-nanosecond intervals since the start of the year 1601.

The size of the buffer passed in the FileInformation parameter to FltQueryVolumeInformation or ZwQueryVolumeInformationFile must be at least sizeof (FILE_FS_VOLUME_INFORMATION).

This structure must be aligned on a LONGLONG (8-byte) boundary.

Requirements

Requirement Value
Header ntddk.h (include Ntddk.h, Ntifs.h, Fltkernel.h)

See also

FltQueryVolumeInformation

IRP_MJ_QUERY_VOLUME_INFORMATION

ZwQueryVolumeInformationFile