FsRtlNotifyVolumeEventEx function (ntifs.h)

Article
02/22/2024

The FsRtlNotifyVolumeEventEx routine notifies any registered applications that a volume event is occurring. Volume events include the volume being locked, unlocked, mounted, or made read-only.

Syntax

NTSTATUS FsRtlNotifyVolumeEventEx(
  [in] PFILE_OBJECT                       FileObject,
  [in] ULONG                              EventCode,
  [in] PTARGET_DEVICE_CUSTOM_NOTIFICATION Event
);

Parameters

[in] FileObject

A pointer to a FILE_OBJECT that specifies a volume.

[in] EventCode

An event code for the event that is occurring. For a table of event codes, see FsRtlNotifyVolumeEvent.

[in] Event

A pointer to the initialized custom notification structure (TARGET_DEVICE_CUSTOM_NOTIFICATION) to use.

Return value

Returns STATUS_SUCCESS on success or another relevant NTSTATUS value, such as STATUS_INVALID_PARAMETER, if the EventCode is not valid.

Remarks

Note When you specify the Event parameter as a custom volume notification, set the following members of the TARGET_DEVICE_CUSTOM_NOTIFICATION object as follows:

Version to 1.

FileObject to NULL.

Requirements

Requirement	Value
Minimum supported client	Windows Vista
Target Platform	Universal
Header	ntifs.h (include FltKernel.h, Ntifs.h)
Library	NtosKrnl.lib
DLL	NtosKrnl.exe
IRQL	<=DISPATCH_LEVEL