FltRetrieveFileInfoOnCreateCompletion - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
// fltkernel.h
PVOID FLTAPI FltRetrieveFileInfoOnCreateCompletion(
[in] PFLT_FILTER Filter,
[in] PFLT_CALLBACK_DATA Data,
[in] ULONG InfoClass,
[out] PULONG Size
);
View the official Windows Driver Kit DDI referenceNo description available.
FltRetrieveFileInfoOnCreateCompletion retrieves the requested file information during file post create. Use FltRetrieveFileInfoOnCreateCompletionEx to get an NTSTATUS code along with the requested information.
Filter [in]Opaque filter pointer that uniquely identifies the minifilter driver.
Data [in]Pointer to the FLT_CALLBACK_DATA callback data representing the I/O operation.
InfoClass [in]Flag that indicates the type of information to return. Note that flags cannot be combined. Can be one of the following values:
| Flag | Meaning |
|---|---|
| QoCFileStatInformation (0x00000001) | The file system will return file stat information in a QUERY_ON_CREATE_FILE_STAT_INFORMATION structure. |
| QoCFileLxInformation (0x00000002) | The file system will return extended Linux-like information in a QUERY_ON_CREATE_FILE_LX_INFORMATION structure. |
| QoCFileEaInformation (0x00000004) | The file system will return extended attributes (EA) in a QUERY_ON_CREATE_EA_INFORMATION structure. |
| QoCFileUsnInformation (0x00000008) | The file system will return USN information in a QUERY_ON_CREATE_USN_INFORMATION structure. |
| QoCFileSecurityInformation (0x00000010) | The file system will return file security information in a QUERY_ON_CREATE_SECURITY_INFORMATION structure. |
Size [out]Pointer to a ULONG that specifies the size, in bytes, of the buffer that this function returns.
FltRetrieveFileInfoOnCreateCompletion returns a pointer to a buffer with the requested file information. The structure within the buffer is determined by the value of InfoClass. If the file system processes the request but can't find the requested file information, this parameter is set to NULL.
A minifilter must call FltRequestFileInfoOnCreateCompletion during file pre-create to specify which file information the file system should track.
FltRequestFileInfoOnCreateCompletion
FltRetrieveFileInfoOnCreateCompletionEx