FltGetVolumeFromFileObject - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
// fltkernel.h
NTSTATUS FLTAPI FltGetVolumeFromFileObject(
[in] PFLT_FILTER Filter,
[in] PFILE_OBJECT FileObject,
[out] PFLT_VOLUME *RetVolume
);
View the official Windows Driver Kit DDI referenceNo description available.
The FltGetVolumeFromFileObject routine returns an opaque pointer for the volume that a given file stream resides on.
Filter [in]Opaque filter pointer for the caller. This parameter is required and cannot be NULL.
FileObject [in]File object pointer for a file stream that resides on the volume.
RetVolume [out]Pointer to a caller-allocated variable that receives an opaque pointer for the volume. This parameter is required and cannot be NULL.
FltGetVolumeFromFileObject returns STATUS_SUCCESS or an appropriate NTSTATUS value, such as one of the following:
| Return code | Description |
|---|---|
| STATUS_FLT_DELETING_OBJECT | The volume is being torn down. This is an error code. |
| STATUS_INVALID_PARAMETER | No matching volume was found. This is an error code. |
FltGetVolumeFromFileObject adds a rundown reference to the opaque volume pointer returned in the RetVolume parameter. When this pointer is no longer needed, the caller must release it by calling FltObjectDereference. Thus every successful call to FltGetVolumeFromFileObject must be matched by a subsequent call to FltObjectDereference.
To get a pointer to the device object for a given volume, call FltGetDeviceObject.