Edit

FILE_STAT_BASIC_INFORMATION structure (ntifs.h)

  • Article

Important

Some information relates to a prerelease product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.

FILE_STAT_BASIC_INFORMATION contains basic metadata about a file.

Syntax

typedef struct _FILE_STAT_BASIC_INFORMATION {
  LARGE_INTEGER FileId;
  LARGE_INTEGER CreationTime;
  LARGE_INTEGER LastAccessTime;
  LARGE_INTEGER LastWriteTime;
  LARGE_INTEGER ChangeTime;
  LARGE_INTEGER AllocationSize;
  LARGE_INTEGER EndOfFile;
  ULONG         FileAttributes;
  ULONG         ReparseTag;
  ULONG         NumberOfLinks;
  ULONG         DeviceType;
  ULONG         DeviceCharacteristics;
  ULONG         Reserved;
  LARGE_INTEGER VolumeSerialNumber;
  FILE_ID_128   FileId128;
} FILE_STAT_BASIC_INFORMATION, *PFILE_STAT_BASIC_INFORMATION;

Members

FileId

Specifies the id of a file.

CreationTime

Specifies the creation time of a file.

LastAccessTime

Specifies the last time a file was accessed.

LastWriteTime

Specifies the last time a file was written to.

ChangeTime

Specifies the last time a file was changed.

AllocationSize

File allocation size, in bytes. Usually this value is a multiple of the sector or cluster size of the underlying physical device.

EndOfFile

Absolute new end-of-file position as a byte offset from the start of the file. EndOfFile specifies the byte offset to the end of the file. Because this value is zero-based, it actually refers to the first free byte in the file. In other words, EndOfFile is the offset to the byte immediately following the last valid byte in the file.

FileAttributes

File attributes, which can be any valid combination of the following:

Attribute Value
FILE_ATTRIBUTE_READONLY 0x00000001
FILE_ATTRIBUTE_HIDDEN 0x00000002
FILE_ATTRIBUTE_SYSTEM 0x00000004
FILE_ATTRIBUTE_DIRECTORY 0x00000010
FILE_ATTRIBUTE_ARCHIVE 0x00000020
FILE_ATTRIBUTE_NORMAL 0x00000080

ReparseTag

Reparse point tag. See About reparse points for more information.

NumberOfLinks

Specifies the number of links to the file.

DeviceType

Set when a driver calls IoCreateDevice as appropriate for the type of underlying device. For more information, see Specifying Device Types.

DeviceCharacteristics

The device characteristics. For a description of relevant values, see DEVICE_OBJECT.

Reserved

Reserved for system use.

VolumeSerialNumber

Serial number of the volume where the file is located.

FileId128

The 128-byte file reference number for the file. This number is generated and assigned to the file by the file system.

Remarks

This information can be queried in either of the following ways:

  • Call ZwQueryDirectoryFile, passing FileStatBasicInformation as the value of FileInformationClass and passing a caller-allocated, FILE_ID_EXTD_DIR_INFORMATION-structured buffer as the value of FileInformation.

  • Create an IRP with major function code IRP_MJ_DIRECTORY_CONTROL and minor function code IRP_MN_QUERY_DIRECTORY.

No specific access rights are required to query this information.

File reference numbers, also called file IDs, are guaranteed to be unique only within a static file system. They are not guaranteed to be unique over time, because file systems are free to reuse them. Nor are they guaranteed to remain constant. For example, the FAT file system generates the file reference number for a file from the byte offset of the file's directory entry record (DIRENT) on the disk. Defragmentation can change this byte offset. Thus a FAT file reference number can change over time.

All dates and times are in absolute system-time format. Absolute system time is the number of 100-nanosecond intervals since the start of the year 1601.

This structure must be aligned on a LONGLONG (8-byte) boundary. If a buffer contains two or more of these structures, the NextEntryOffset value in each entry, except the last, falls on an 8-byte boundary.

Requirements

Requirement Value
Minimum supported client Windows 11, version 24H2
Header ntifs.h

See also

FILE_INFORMATION_CLASS

**ZwQueryInformationByName **