FltGetCopyInformationFromCallbackData - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
// fltkernel.h
NTSTATUS FLTAPI FltGetCopyInformationFromCallbackData(
[in] PFLT_CALLBACK_DATA Data,
[out] PCOPY_INFORMATION CopyInformation
);
View the official Windows Driver Kit DDI referenceNo description available.
The FltGetCopyInformationFromCallbackData routine retrieves copy information from the callback data, if present. The copy information is in the IRP extension for read/write calls coming from NtCopyFileChunk.
Data [in]Pointer to a FLT_CALLBACK_DATA structure that holds the callback data.
CopyInformation [out]Pointer to a COPY_INFORMATION structure into which the copy information will be written.
FltGetCopyInformationFromCallbackData returns STATUS_SUCCESS upon success, or an error code such as the following.
| Error code | Meaning |
|---|---|
| STATUS_INVALID_PARAMETER | The callback data is not for an IRP operation. |
| STATUS_NOT_FOUND | The copy information IRP extension was not set on the IRP. |
Any trusted read or write operations from NtCopyFileChunk will have the following:
Filters do not have access to IRP extensions directly, but can check for the presence of the copy extension and get copy information by calling FltGetCopyInformationFromCallbackData.
See Kernel-mode file copy and detecting copy file scenarios for more information.
IoCheckFileObjectOpenedAsCopyDestination
IoCheckFileObjectOpenedAsCopySource