IoCheckFileObjectOpenedAsCopySource function (ntifs.h)

Article
02/22/2024

The IoCheckFileObjectOpenedAsCopySource routine checks whether a file was previously opened with copy intent as a source file.

Syntax

BOOLEAN IoCheckFileObjectOpenedAsCopySource(
  [in] PFILE_OBJECT FileObject
);

Parameters

[in] FileObject

Pointer to the source file object to check for copy intent.

Return value

IoCheckFileObjectOpenedAsCopySource returns TRUE if the file object represents a source file that was previously opened with copy file intent; otherwise it returns FALSE. A return value of TRUE only signals the intent at create time; it does not mean that all operations on the file object are all part of copies.

Remarks

The following example shows how to check if a file object was opened with copy intent.


typedef  
BOOLEAN (*PIO_CHECK_FILE_OBJECT_OPENED_AS_COPY_SOURCE)( 
    _In_ PFILE_OBJECT FileObject 
); 
typedef  
BOOLEAN (*PIO_CHECK_FILE_OBJECT_OPENED_AS_COPY_DESTINATION)( 
    _In_ PFILE_OBJECT FileObject 
); 

PIO_CHECK_FILE_OBJECT_OPENED_AS_COPY_SOURCE IoCheckFileObjectOpenedAsCopySource; 
PIO_CHECK_FILE_OBJECT_OPENED_AS_COPY_DESTINATION IoCheckFileObjectOpenedAsCopyDestination;

// First resolve the API 
RtlInitUnicodeString(&RoutineName, L"IoCheckFileObjectOpenedAsCopySource"); 
IoCheckFileObjectOpenedAsCopySource = (PIO_CHECK_FILE_OBJECT_OPENED_AS_COPY_SOURCE)MmGetSystemRoutineAddress(&RoutineName); 

RtlInitUnicodeString(&RoutineName, L"IoCheckFileObjectOpenedAsCopyDestination"); 
IoCheckFileObjectOpenedAsCopyDestination = (PIO_CHECK_FILE_OBJECT_OPENED_AS_COPY_DESTINATION)MmGetSystemRoutineAddress(&RoutineName); 

// Now use the API 
IoCheckFileObjectOpenedAsCopySource(FltObjects->FileObject); 
IoCheckFileObjectOpenedAsCopyDestination(FltObjects->FileObject);

See Kernel-mode file copy and detecting copy file scenarios for more information.

Requirements

Requirement	Value
Minimum supported client	Windows 11, version 22H2
Header	ntifs.h (include Wdm.h, Ntddk.h, Ntifs.h)
IRQL	PASSIVE_LEVEL