FILE_INTERNAL_INFORMATION - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
#ifndef _NTIOAPI_H
/**
* The FILE_INTERNAL_INFORMATION structure is used to query for the file system's 8-byte file reference number for a file.
* \sa https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/ns-ntifs-_file_internal_information
* \remark The IndexNumber member is the same as the FileId member of the FILE_ID_BOTH_DIR_INFORMATION and FILE_ID_FULL_DIR_INFORMATION structures.
*/
typedef struct _FILE_INTERNAL_INFORMATION
{
union
{
ULARGE_INTEGER IndexNumber;
struct
{
ULONGLONG MftRecordIndex : 48; // rev
ULONGLONG SequenceNumber : 16; // rev
};
};
} FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;
View code on GitHub// ntifs.h
typedef struct _FILE_INTERNAL_INFORMATION {
LARGE_INTEGER IndexNumber;
} FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;
View the official Windows Driver Kit DDI referenceNo description available.
The FILE_INTERNAL_INFORMATION structure is used to query for the file system's 8-byte file reference number for a file.
IndexNumberThe 8-byte file reference number for the file. This number is assigned by the file system and is file-system-specific. (Note that this is not the same as the 16-byte "file object ID" that was added to NTFS for Microsoft Windows 2000.)
This information can be queried in either of the following ways:
Call FltQueryInformationFile or ZwQueryInformationFile, passing FileInternalInformation as the value of FileInformationClass and passing a caller-allocated, FILE_INTERNAL_INFORMATION-structured buffer as the value of FileInformation.
Create an IRP with major function code IRP_MJ_QUERY_INFORMATION.
No specific access rights are required to query this information.
The IndexNumber member of the FILE_INTERNAL_INFORMATION structure is the same as the FileId member of the FILE_ID_BOTH_DIR_INFORMATION and FILE_ID_FULL_DIR_INFORMATION structures.
File reference numbers, also called file IDs, are guaranteed to be unique only within a static file system. They are not guaranteed to be unique over time, because file systems are free to reuse them. Nor are they guaranteed to remain constant. For example, the FAT file system generates the file reference number for a file from the byte offset of the file's directory entry record (DIRENT) on the disk. Defragmentation can change this byte offset. Thus a FAT file reference number can change over time.
The size of the buffer passed in the FileInformation parameter to FltQueryInformationFile or ZwQueryInformationFile must be at least sizeof(FILE_INTERNAL_INFORMATION).
This structure must be aligned on a LONGLONG (8-byte) boundary.
This structure is documented in Windows Driver Kit.
FILE_INTERNAL_INFORMATION structure is a result of call NtQueryInformationFile with FileInternalInformation information class. It's not possible to set file unique identifier.
File identifier, unique for file's device.