ZwQueryInformationFile

NTSTATUS
ZwQueryInformationFile(
IN HANDLE FileHandle,
OUT PIO_STATUS_BLOCK IoStatusBlock,
OUT PVOID FileInformation,
IN ULONG Length,
IN FILE_INFORMATION_CLASS FileInformationClass
);

ZwQueryInformationFile returns various kinds of information about a given file object.

Parameters

FileHandle

Is the handle returned by a successful call to ZwCreateFile.

IoStatusBlock

Points to a variable that receives the final completion status and information about the operation.

FileInformation

Points to a caller-allocated buffer or variable that receives the desired information about the file. The contents of FileInformation are defined by the FileInformationClass parameter, described later.

Length

Specifies the size in bytes of FileInformation, which the caller should set according to the given FileInformationClass.

FileInformationClass

Specifies the type of information to be returned about the file. Device and intermediate drivers, can specify any of the following:

FileInformationClass Value	Meaning
FileBasicInformation	Return FILE_BASIC_INFORMATION about the file. The caller must have opened the file with the DesiredAccess FILE_READ_ATTRIBUTES flag set.
FileStandardInformation	Return FILE_STANDARD_INFORMATION about the file. The caller can query this information as long as the file is open, without any particular requirements for DesiredAccess.
FilePositionInformation	Return FILE_POSITION_INFORMATION about the file. The caller must have opened the file with the DesiredAccess FILE_READ_DATA or FILE_WRITE_DATA flag set and with either of the CreateOptions FILE_SYNCHRONOUS_IO_ALERT or FILE_SYNCHRONOUS_IO_NONALERT.
FileAlignmentInformation	Return FILE_ALIGNMENT_INFORMATION about the file. The caller can query this information as long as the file is open, without any particular requirements for DesiredAccess. This information is useful if the file was opened with the CreateOptions FILE_NO _INTERMEDIATE_BUFFERING flag set.

Return Value

ZwQueryInformationFile returns STATUS_SUCCESS or an appropriate error status. It also returns the number of bytes actually written to the given FileInformation buffer in the Information member of IoStatusBlock.

Comments

ZwQueryInformationFile returns information about the given file. Note that it returns zero in any member of a FILE_XXX_INFORMATION structure that is not supported by a particular device or file system. For example, the FAT file system does not support file-creation times, so ZwQueryInformationFile sets the CreationTime member of returned FILE_BASIC_INFORMATION to zero for files on a FAT partition.

Callers of ZwQueryInformationFile must be running at IRQL PASSIVE_LEVEL.