FSCTL_REMOVE_OVERLAY - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
// ntifs.h
// CTL_CODE(0x0009, 0x0cd, METHOD_BUFFERED, FILE_WRITE_ACCESS)
#define FSCTL_REMOVE_OVERLAY 0x00098334
View the official Windows hardware development documentationNo description available.
The FSCTL_REMOVE_OVERLAY control code removes a backing source from a volume.
To perform this operation, call FltFsControlFile or ZwFsControlFile with the following parameters.
Instance [in]: FltFsControlFile only. An opaque instance pointer for the caller. This parameter is required and cannot be NULL.
FileObject [in]: FltFsControlFile only. The file pointer object of the volume from which the overlay is removed. This parameter is required and cannot be NULL.
FileHandle [in]: ZwFsControlFile only. The handle of the volume for which the overlay is removed. This parameter is required and cannot be NULL.
FsControlCode [in]: The control code for the operation. Use FSCTL_REMOVE_OVERLAY for this operation.
InputBuffer [in]: A pointer to the input buffer, which must contain a WOF_EXTERNAL_INFO structure. When required, additional provider specific data is included immediately after WOF_EXTERNAL_INFO. If the provider is a WIM file, a WIM_PROVIDER_REMOVE_OVERLAY_INPUT structure is included after WOF_EXTERNAL_INFO.
InputBufferLength [in]: Set to sizeof(WOF_EXTERNAL_INFO) plus the size of any additional provider input data.
OutputBuffer [out]: Not used. Set to NULL.
OutputBufferLength [in]: Set to 0.
FltFsControlFile or ZwFsControlFile returns STATUS_SUCCESS if the operation succeeds. Otherwise, the appropriate function might return one of the following NTSTATUS values.
| Code | Meaning |
|---|---|
| STATUS_ACCESS_DENIED | The requester does not have administrative privileges. |
| STATUS_BUFFER_TOO_SMALL | The length of the output buffer pointed to by OutputBuffer, and specified by OutputBufferLength, is too small. |
| STATUS_INTERNAL_ERROR | The requested volume is not accessible. |
| STATUS_INVALID_DEVICE_REQUEST | The backing service is not present or not started. |
When the backing source to remove is a Windows Imaging Format (WIM) file, the input buffer will contain a WOF_EXTERNAL_INFO structure followed by a WIM_PROVIDER_REMOVE_OVERLAY_INPUT structure. The InputBufferLength in this case will be sizeof(WOF_EXTERNAL_INFO) + sizeof(WIM_PROVIDER_REMOVE_OVERLAY_INPUT). The DataSourceId value in WIM_PROVIDER_REMOVE_OVERLAY_INPUT must be for a WIM file previously added in an FSCTL_ADD_OVERLAY request.
Additional backing providers will define their own specific input parameter structures.
| Requirement type | Requirement |
|---|---|
| Minimum supported client | Windows 8.1 Update |
| Header | Ntifs.h (include Ntifs.h or Fltkernel.h) |