FSCTL_QUERY_RETRIEVAL_POINTERS - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers
// ntifs.h

// CTL_CODE(0x0009, 0x00e, METHOD_NEITHER, FILE_ANY_ACCESS)
#define FSCTL_QUERY_RETRIEVAL_POINTERS 0x0009003B
View the official Windows hardware development documentation

NtDoc

No description available.

Windows hardware development documentation (fsctl-query-retrieval-pointers)

FSCTL_QUERY_RETRIEVAL_POINTERS control code

The FSCTL_QUERY_RETRIEVAL_POINTERS control code retrieves a mapping between virtual cluster numbers (VCN, offsets within the file/stream space) and logical cluster numbers (LCN, offsets within the volume space), starting at the beginning of the file up to the map size specified in InputBuffer.

FSCTL_QUERY_RETRIEVAL_POINTERS is similar to FSCTL_GET_RETRIEVAL_POINTERS. However, FSCTL_QUERY_RETRIEVAL_POINTERS only works in kernel mode on local paging files or the system hives. The paging file is guaranteed to have a one-to-one mapping from the VCN in a volume to the LCN that refer more directly to the underlying physical storage. You must not use FSCTL_QUERY_RETRIEVAL_POINTERS with files other than the page file, because they might reside on volumes, such as mirrored volumes, that have one-to-many mappings of VCNs to LCNs.

To perform this operation, call FltFsControlFile or ZwFsControlFile with the following parameters.

Parameters

  struct {
   LONGLONG  SectorLengthInBytes;
   LONGLONG  StartingLogicalOffsetInBytes;
    } MappingPair;
 

This array of quadlet pairs defines the disk runs of the file. The value of the SectorLengthInBytes member in the last element of the array is zero.

Status block

FltFsControlFile and ZwFsControlFile both return STATUS_SUCCESS or an appropriate NTSTATUS error value.

Remarks

This code is not supported by ReFS.

Requirements

Requirement type Requirement
Header Ntifs.h (include Ntifs.h)

See also

FltFsControlFile

FSCTL_GET_RETRIEVAL_POINTERS

ZwFsControlFile