FILE_FULL_DIR_INFORMATION - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
#ifndef _NTIOAPI_H
typedef struct _FILE_FULL_DIR_INFORMATION
{
ULONG NextEntryOffset;
ULONG FileIndex;
LARGE_INTEGER CreationTime;
LARGE_INTEGER LastAccessTime;
LARGE_INTEGER LastWriteTime;
LARGE_INTEGER ChangeTime;
LARGE_INTEGER EndOfFile;
LARGE_INTEGER AllocationSize;
ULONG FileAttributes;
ULONG FileNameLength;
ULONG EaSize;
_Field_size_bytes_(FileNameLength) WCHAR FileName[1];
} FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION;
View code on GitHub// ntifs.h
typedef struct _FILE_FULL_DIR_INFORMATION {
ULONG NextEntryOffset;
ULONG FileIndex;
LARGE_INTEGER CreationTime;
LARGE_INTEGER LastAccessTime;
LARGE_INTEGER LastWriteTime;
LARGE_INTEGER ChangeTime;
LARGE_INTEGER EndOfFile;
LARGE_INTEGER AllocationSize;
ULONG FileAttributes;
ULONG FileNameLength;
ULONG EaSize;
WCHAR FileName[1];
} FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION;
View the official Windows Driver Kit DDI referenceNo description available.
The FILE_FULL_DIR_INFORMATION structure is used to query detailed information for the files in a directory.
NextEntryOffsetByte offset of the next FILE_FULL_DIR_INFORMATION entry, if multiple entries are present in a buffer. This member is zero if no other entries follow this one.
FileIndexByte offset of the file within the parent directory. This member is undefined for file systems, such as NTFS, in which the position of a file within the parent directory is not fixed and can be changed at any time to maintain sort order.
CreationTimeTime when the file was created.
LastAccessTimeLast time the file was accessed.
LastWriteTimeLast time information was written to the file.
ChangeTimeLast time the file was changed.
EndOfFileAbsolute new end-of-file position as a byte offset from the start of the file. EndOfFile specifies the byte offset to the end of the file. Because this value is zero-based, it actually refers to the first free byte in the file. In other words, EndOfFile is the offset to the byte immediately following the last valid byte in the file.
AllocationSizeFile allocation size, in bytes. Usually, this value is a multiple of the sector or cluster size of the underlying physical device.
FileAttributesFile attributes, which can be any valid combination of the following:
FileNameLengthSpecifies the length of the file name string.
EaSizeCombined length, in bytes, of the extended attributes (EA) for the file.
FileNameSpecifies the first character of the file name string. This is followed in memory by the remainder of the string.
This information can be queried in either of the following ways:
Call ZwQueryDirectoryFile, passing FileFullDirectoryInformation as the value of FileInformationClass and passing a caller-allocated, FILE_FULL_DIR_INFORMATION-structured buffer as the value of FileInformation.
Create an IRP with major function code IRP_MJ_DIRECTORY_CONTROL and minor function code IRP_MN_QUERY_DIRECTORY.
No specific access rights are required to query this information.
All dates and times are in absolute system-time format. Absolute system time is the number of 100-nanosecond intervals since the start of the year 1601.
This structure must be aligned on a LONGLONG (8-byte) boundary. If a buffer contains two or more of these structures, the NextEntryOffset value in each entry, except the last, falls on an 8-byte boundary.
FsRtlNotifyFullChangeDirectory
This structure is documented in Windows Driver Kit.
Structure FILE_FULL_DIR_INFORMATION is returned as a result of call NtQueryDirectoryFile with FileFullDirectoryInformation
information class. It contains some typical information about directory entries, like a FILE_DIRECTORY_INFORMATION structure, but additionally contains member specifying size of Extended Attributes.
Offset (in bytes) of next FILE_FULL_DIR_INFORMATION structure placed in result buffer. If there's no more entries, NextEntryOffset is set to zero.
File index value, or zero, if directory indexing is not available.
Time of object creation.
Last access time. Means time when last open operation was performed.
Time of last write data.
Time of last change.
Specify length of file, in bytes.
Specify real size of file on device. It must be equal or greater to EndOfFile member.
Attributes of file.
Length of FileName array, in bytes.
Size of Extended Attributes associated with file. See also FILE_EA_INFORMATION structure.
UNICODE string specifying file name.