FSCTL_LOOKUP_STREAM_FROM_CLUSTER IOCTL

Description

Given a handle to a NTFS volume or a file on a NTFS volume, returns a chain of data structures that describes streams that occupy the specified clusters.

[!IMPORTANT] FSCTL_LOOKUP_STREAM_FROM_CLUSTER is a very resource-intensive operation, and typically uses a very large amount of disk bandwidth, memory, and time. It is unlikely that much of this information will remain in cache so a second call to FSCTL_LOOKUP_STREAM_FROM_CLUSTER would take nearly as much time as the first call. For doing multiple lookups it's more efficient to use FSCTL_ENUM_USN_DATA to enumerate every MFT record and then use FSCTL_GET_RETRIEVAL_POINTERS to gather the data to map between clusters and streams.

To perform this operation, call the DeviceIoControl function with the following parameters.

BOOL DeviceIoControl(
  (HANDLE)       hDevice,               // handle to file, directory, or volume
  FSCTL_LOOKUP_STREAM_FROM_CLUSTER,     // dwIoControlCode
  (LPVOID)       lpInBuffer,            // input buffer
  (DWORD)        nInBufferSize,         // size of input buffer
  (LPVOID)       lpOutBuffer,           // output buffer
  (DWORD)        nOutBufferSize,        // size of output buffer
  (LPDWORD)      lpBytesReturned,       // number of bytes returned
  (LPOVERLAPPED) lpOverlapped           // OVERLAPPED structure
);

Parameters

Input buffer

Input buffer length

Output buffer

Output buffer length

Input/output buffer

Input/output buffer length

Status block

Irp->IoStatus.Status is set to STATUS_SUCCESS if the request is successful.

Otherwise, Status to the appropriate error condition as a NTSTATUS code.

For more information, see NTSTATUS Values.

Remarks

In Windows 8 and Windows Server 2012, this code is supported by the following technologies.

See also

• CreateFile
• Defragmentation
• DeviceIoControl
• Disk Management Control Codes
• GetLastError
• GetOverlappedResult
• GetQueuedCompletionStatus
• LOOKUP_STREAM_FROM_CLUSTER_ENTRY
• LOOKUP_STREAM_FROM_CLUSTER_INPUT
• LOOKUP_STREAM_FROM_CLUSTER_OUTPUT
• OVERLAPPED