ZwQueryEaFile function (ntifs.h)

The ZwQueryEaFile routine returns information about extended-attribute (EA) values for a file.


  [in]           HANDLE           FileHandle,
  [out]          PIO_STATUS_BLOCK IoStatusBlock,
  [out]          PVOID            Buffer,
  [in]           ULONG            Length,
  [in]           BOOLEAN          ReturnSingleEntry,
  [in, optional] PVOID            EaList,
  [in]           ULONG            EaListLength,
  [in, optional] PULONG           EaIndex,
  [in]           BOOLEAN          RestartScan


[in] FileHandle

The handle for the file on which the operation is to be performed.

[out] IoStatusBlock

A pointer to an IO_STATUS_BLOCK structure that receives the final completion status and other information about the requested operation.

[out] Buffer

A pointer to a caller-supplied FILE_FULL_EA_INFORMATION-structured output buffer, where the extended attribute values are to be returned.

[in] Length

The length, in bytes, of the buffer that the Buffer parameter points to.

[in] ReturnSingleEntry

Set to TRUE if ZwQueryEaFile should return only the first entry that is found.

[in, optional] EaList

A pointer to a caller-supplied FILE_GET_EA_INFORMATION-structured input buffer, which specifies the extended attributes to be queried. This parameter is optional and can be NULL.

[in] EaListLength

The length, in bytes, of the buffer that the EaList parameter points to.

[in, optional] EaIndex

The index of the entry at which scanning the file's extended-attribute list should begin. This parameter is ignored if the EaList parameter points to a nonempty list. This parameter is optional and can be NULL.

[in] RestartScan

Set to TRUE if ZwQueryEaFile should begin the scan at the first entry in the file's extended-attribute list. If this parameter is set to FALSE, the routine resumes the scan from a previous call to ZwQueryEaFile.

Return value

ZwQueryEaFile returns STATUS_SUCCESS or an appropriate NTSTATUS value such as the following:

Return value Description
The file system does not support extended attributes. This is an error code.
The ZwQueryEaFile routine encountered a pool allocation failure. This is an error code.
The EaList parameter is not formatted correctly. This is an error code.


Minimum supported client Windows 2000
Target Platform Universal
Header ntifs.h (include FltKernel.h, Ntifs.h)
Library NtosKrnl.lib
DLL NtosKrnl.exe
DDI compliance rules HwStorPortProhibitedDDIs(storport), PowerIrpDDis(wdm)

See also