FILE_BASIC_INFORMATION - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers 
#ifndef _NTIOAPI_H

/**
 * The FILE_BASIC_INFORMATION structure contains timestamps and basic attributes of a file.
 * \li If you specify a value of zero for any of the XxxTime members, the file system keeps a file's current value for that time.
 * \li If you specify a value of -1 for any of the XxxTime members, time stamp updates are disabled for I/O operations performed on the file handle.
 * \li If you specify a value of -2 for any of the XxxTime members, time stamp updates are enabled for I/O operations performed on the file handle.
 * \remarks To set the members of this structure, the caller must have FILE_WRITE_ATTRIBUTES access to the file.
 * \sa https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/ns-wdm-_file_basic_information
 */
typedef struct _FILE_BASIC_INFORMATION
{
    LARGE_INTEGER CreationTime;         // Specifies the time that the file was created.
    LARGE_INTEGER LastAccessTime;       // Specifies the time that the file was last accessed.
    LARGE_INTEGER LastWriteTime;        // Specifies the time that the file was last written to.
    LARGE_INTEGER ChangeTime;           // Specifies the last time the file was changed.
    ULONG FileAttributes;               // Specifies one or more FILE_ATTRIBUTE_XXX flags.
} FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;

#endif

View code on GitHub
// wdm.h

typedef struct _FILE_BASIC_INFORMATION {
  LARGE_INTEGER CreationTime;
  LARGE_INTEGER LastAccessTime;
  LARGE_INTEGER LastWriteTime;
  LARGE_INTEGER ChangeTime;
  ULONG         FileAttributes;
} FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;
View the official Windows Driver Kit DDI reference

NtDoc

No description available.

Edit description on GitHub

Windows Driver Kit DDI reference (ns-wdm-_file_basic_information)

FILE_BASIC_INFORMATION structure

Description

The FILE_BASIC_INFORMATION structure contains timestamps and basic attributes of a file. It is used as an argument to routines that query or set file information.

Members

CreationTime

Specifies the time that the file was created.

LastAccessTime

Specifies the time that the file was last accessed.

LastWriteTime

Specifies the time that the file was last written to.

ChangeTime

Specifies the last time the file was changed.

FileAttributes

Specifies one or more FILE_ATTRIBUTE_XXX flags. For descriptions of these flags, see File Attribute Constants in the Microsoft Windows SDK.

Remarks

The FILE_ATTRIBUTE_NORMAL flag cannot be set or returned in combination with any other attributes. All other FileAttributes values override this attribute.

Time values CreationTime, LastAccessTime, LastWriteTime, and ChangeTime are expressed in absolute system time format. Absolute system time is the number of 100-nanosecond intervals since the start of the year 1601 in the Gregorian calendar.

If you specify a value of zero for any of the XxxTime members of the FILE_BASIC_INFORMATION structure, the ZwSetInformationFile function keeps a file's current setting for that time.

The file system updates the values of the LastAccessTime, LastWriteTime, and ChangeTime members as appropriate after an I/O operation is performed on a file. A driver or application can request that the file system not update one or more of these members for I/O operations that are performed on the caller's file handle by setting the appropriate members to -1. The caller can set one, all, or any other combination of these three members to -1. Only the members that are set to -1 will be unaffected by I/O operations on the file handle; the other members will be updated as appropriate. On NTFS and ReFS systems, time stamp updates on the file handle can be restored by setting the appropriate member(s) to -2.

To set the members of this structure, the caller must have FILE_WRITE_ATTRIBUTES access to the file.

See also

KeQuerySystemTime

ZwCreateFile

ZwQueryInformationFile

ZwSetInformationFile

View the official Windows Driver Kit DDI reference

Edit description on GitHub

NTinternals.net (undocumented.ntinternals.net)

This structure is documented in Windows Driver Kit.

Structure FILE_BASIC_INFORMATION is used in a call to function NtSetInformationFile with FileBasicInformation information class, and is received in a call to NtQueryInformationFile with the same information class. Also function NtQueryAttributesFile uses as a result FILE_BASIC_INFORMATION, but it fills only FileAttributes field. See required function's description for details.

CreationTime

Time of file creation, in 100-ns units.

LastAccessTime

Time of last open operation, in 100-ns units.

LastWriteTime

Time of last write operation, in 100-ns units.

ChangeTime

Time of any last change, in 100-ns units.

FileAttributes

File attributes. See NtCreateFile for possibilities.

Structure is also available in Microsoft DDK.

Documented by

See also

Edit description on GitHub