#ifndef _NTIOAPI_H

//
// NtQueryVolumeInformation/NtSetVolumeInformation types
//

typedef struct _FILE_FS_VOLUME_INFORMATION
{
    LARGE_INTEGER VolumeCreationTime;
    ULONG VolumeSerialNumber;
    ULONG VolumeLabelLength;
    BOOLEAN SupportsObjects;
    _Field_size_bytes_(VolumeLabelLength) WCHAR VolumeLabel[1];
} FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION;

#endif
View code on GitHub

// ntddk.h

typedef struct _FILE_FS_VOLUME_INFORMATION {
  LARGE_INTEGER VolumeCreationTime;
  ULONG         VolumeSerialNumber;
  ULONG         VolumeLabelLength;
  BOOLEAN       SupportsObjects;
  WCHAR         VolumeLabel[1];
} FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION;
View the official Windows Driver Kit DDI reference

NtDoc

No description available.

Edit description on GitHub

Windows Driver Kit DDI reference (ns-ntddk-_file_fs_volume_information)

_FILE_FS_VOLUME_INFORMATION structure

Description

The FILE_FS_VOLUME_INFORMATION structure is used to query information about a volume on which a file system is mounted.

Members

`VolumeCreationTime`

Time when the volume was created.

`VolumeSerialNumber`

Serial number of the volume.

`VolumeLabelLength`

Length, in bytes, of the name of the volume.

`SupportsObjects`

TRUE if the file system supports object-oriented file system objects, FALSE otherwise.

`VolumeLabel`

Name of the volume.

Remarks

This information can be queried in either of the following ways:

Call FltQueryVolumeInformation or ZwQueryVolumeInformationFile, passing FileFsVolumeInformation as the value of FileInformationClass and passing a caller-allocated, FILE_FS_VOLUME_INFORMATION-structured buffer as the value of FileInformation.
Create an IRP with major function code IRP_MJ_QUERY_VOLUME_INFORMATION.

No specific access rights are required to query this information. Thus this information is available as long as the volume is accessed through an open handle to the volume itself, or to a file or directory on the volume.

All dates and times are in absolute system-time format. Absolute system time is the number of 100-nanosecond intervals since the start of the year 1601.

The size of the buffer passed in the FileInformation parameter to FltQueryVolumeInformation or ZwQueryVolumeInformationFile must be at least sizeof (FILE_FS_VOLUME_INFORMATION).

This structure must be aligned on a LONGLONG (8-byte) boundary.

NTinternals.net (undocumented.ntinternals.net)

This structure is documented in Windows Driver Kit.

Structure provides basic information about volume. It's filled in a result of call NtQueryVolumeInformationFile with FileFsVolumeInformation class.

VolumeCreationTime

It means time of last Volume Formatting Process.

VolumeSerialNumber

Serial number of volume, associated in Volume Formatting Process.

VolumeLabelLength

Length of VolumeLabel array, in bytes.

SupportsObjects

If TRUE, Object Files can be stored on specified volume.

VolumeLabel[1]

Name of volume. Can be set with FileFsLabelInformation.

Documented by

Bo Branten
Tomasz Nowak

FILE_FS_VOLUME_INFORMATION - NtDoc