Edit

QUERY_ON_CREATE_EA_INFORMATION structure (ntifs.h)

  • Article

The QUERY_ON_CREATE_EA_INFORMATION structure is used to write file information when FltRequestFileInfoOnCreateCompletion is called with the QoCFileEaInformation flag set in the InfoClassFlags parameter.

Syntax

typedef struct _QUERY_ON_CREATE_EA_INFORMATION {
  ULONG                     EaBufferSize;
  PFILE_FULL_EA_INFORMATION EaBuffer;
} QUERY_ON_CREATE_EA_INFORMATION, *PQUERY_ON_CREATE_EA_INFORMATION;

Members

EaBufferSize

Size, in bytes, of the buffer that EaBuffer points to.

EaBuffer

A list of FILE_FULL_EA_INFORMATION structures with extended attribute (EA) information.

Remarks

The file system allocates this structure and fills in the requested information, if supported, while it processes a file create. Filter Manager will free the allocated structure.

Requirements

Requirement Value
Minimum supported client Windows 10, version 1809
Header ntifs.h

See also

FILE_FULL_EA_INFORMATION

FltRequestFileInfoOnCreateCompletion

FltRetrieveFileInfoOnCreateCompletionEx