NtQueryVolumeInformationFile - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers 
#ifndef _NTIOAPI_H

/**
 * The NtQueryVolumeInformationFile routine retrieves information about the volume associated with a given file, directory, storage device, or volume.
 *
 * \param[in] FileHandle A handle to the file, directory, storage device, or volume for which volume information is being requested.
 * \param[out] IoStatusBlock A pointer to an IO_STATUS_BLOCK structure that receives the final completion status, and the number of bytes written to the buffer pointed to by FsInformation. 
 * \param[out] FsInformation A pointer to a caller-allocated buffer that receives the desired information about the volume.
 * \param[in] Length The size, in bytes, of the buffer pointed to by FsInformation.
 * \param[in] FsInformationClass The type of information to be returned about the volume.
 * \return NTSTATUS Successful or errant status.
 * \sa https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-ntqueryvolumeinformationfile
 */
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryVolumeInformationFile(
    _In_ HANDLE FileHandle,
    _Out_ PIO_STATUS_BLOCK IoStatusBlock,
    _Out_writes_bytes_(Length) PVOID FsInformation,
    _In_ ULONG Length,
    _In_ FSINFOCLASS FsInformationClass
    );

#endif

View code on GitHub
#ifndef _NTZWAPI_H

NTSYSCALLAPI
NTSTATUS
NTAPI
ZwQueryVolumeInformationFile(
    _In_ HANDLE FileHandle,
    _Out_ PIO_STATUS_BLOCK IoStatusBlock,
    _Out_writes_bytes_(Length) PVOID FsInformation,
    _In_ ULONG Length,
    _In_ FSINFOCLASS FsInformationClass
    );

#endif

View code on GitHub
// ntddk.h

NTSYSAPI NTSTATUS ZwQueryVolumeInformationFile(
  [in]  HANDLE               FileHandle,
  [out] PIO_STATUS_BLOCK     IoStatusBlock,
  [out] PVOID                FsInformation,
  [in]  ULONG                Length,
  [in]  FS_INFORMATION_CLASS FsInformationClass
);
View the official Windows Driver Kit DDI reference
// ntifs.h

__kernel_entry NTSYSCALLAPI NTSTATUS NtQueryVolumeInformationFile(
  [in]  HANDLE               FileHandle,
  [out] PIO_STATUS_BLOCK     IoStatusBlock,
  [out] PVOID                FsInformation,
  [in]  ULONG                Length,
  [in]  FS_INFORMATION_CLASS FsInformationClass
);
View the official Windows Driver Kit DDI reference
// ntifs.h

NTSYSAPI NTSTATUS ZwQueryVolumeInformationFile(
  [in]  HANDLE               FileHandle,
  [out] PIO_STATUS_BLOCK     IoStatusBlock,
  [out] PVOID                FsInformation,
  [in]  ULONG                Length,
  [in]  FS_INFORMATION_CLASS FsInformationClass
);
View the official Windows Driver Kit DDI reference

NtDoc

No description available.

Edit description on GitHub

Windows Driver Kit DDI reference (nf-ntddk-zwqueryvolumeinformationfile)

Description

The ZwQueryVolumeInformationFile routine retrieves information about the volume associated with a given file, directory, storage device, or volume.

Parameters

FileHandle [in]

A handle to a file object returned by ZwCreateFile or ZwOpenFile for an open file, directory, storage device, or volume for which volume information is being requested.

IoStatusBlock [out]

A pointer to an IO_STATUS_BLOCK structure that receives the final completion status and information about the query operation. For successful calls that return data, the number of bytes written to the FsInformation buffer is returned in the structure's Information member.

FsInformation [out]

A pointer to a caller-allocated buffer that receives the desired information about the volume. The structure of the information returned in the buffer is defined by the FsInformationClass parameter.

Length [in]

Size in bytes of the buffer pointed to by FsInformation. The caller should set this parameter according to the given FsInformationClass.

FsInformationClass [in]

Type of information to be returned about the volume. Set this member to one of the following FS_INFORMATION_CLASS enumeration values.

Value Meaning
FileFsAttributeInformation Return a FILE_FS_ATTRIBUTE_INFORMATION structure containing attribute information about the file system responsible for the volume.
FileFsControlInformation Return a FILE_FS_CONTROL_INFORMATION structure containing file system control information about the volume.
FileFsDeviceInformation Return a FILE_FS_DEVICE_INFORMATION structure containing device information for the volume.
FileFsDriverPathInformation Return a FILE_FS_DRIVER_PATH_INFORMATION structure containing information about whether a specified driver is in the I/O path for the volume. The caller must store the name of the driver into the FILE_FS_DRIVER_PATH_INFORMATION structure before calling ZwQueryVolumeInformationFile.
FileFsFullSizeInformation Return a FILE_FS_FULL_SIZE_INFORMATION structure containing information about the total amount of space available on the volume.
FileFsObjectIdInformation Return a FILE_FS_OBJECTID_INFORMATION structure containing file system-specific object ID information for the volume. Note that this is not the same as the (GUID-based) unique volume name assigned by the operating system.
FileFsSizeInformation Return a FILE_FS_SIZE_INFORMATION structure containing information about the amount of space on the volume that is available to the user associated with the calling thread.
FileFsVolumeInformation Return a FILE_FS_VOLUME_INFORMATION containing information about the volume such as the volume label, serial number, and creation time.
FileFsSectorSizeInformation Return a FILE_FS_SECTOR_SIZE_INFORMATION structure that contains information about the physical and logical sector sizes of a volume.

Return value

ZwQueryVolumeInformationFile returns STATUS_SUCCESS or an appropriate error status.

Remarks

ZwQueryVolumeInformationFile retrieves information about the volume associated with a given file, directory, storage device, or volume.

If the FileHandle represents a direct device open, only FileFsDeviceInformation can be specified as the value of FsInformationClass.

ZwQueryVolumeInformationFile returns zero in any member of a FILE_XXX_INFORMATION structure that is not supported by the file system.

For information about other file information query routines, see File Objects.

Minifilters should use FltQueryVolumeInformationFile instead of ZwQueryVolumeInformationFile.

Callers of ZwQueryVolumeInformationFile must be running at IRQL = PASSIVE_LEVEL and with special kernel APCs enabled.

If the call to the ZwQueryVolumeInformationFile function occurs in user mode, you should use the name "NtQueryVolumeInformationFile" instead of "ZwQueryVolumeInformationFile".

For calls from kernel-mode drivers, the Nt*Xxx* and Zw*Xxx* versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters. For more information about the relationship between the Nt*Xxx* and Zw*Xxx* versions of a routine, see Using Nt and Zw Versions of the Native System Services Routines.

See also

FILE_FS_ATTRIBUTE_INFORMATION

FILE_FS_CONTROL_INFORMATION

FILE_FS_DEVICE_INFORMATION

FILE_FS_DRIVER_PATH_INFORMATION

FILE_FS_FULL_SIZE_INFORMATION

FILE_FS_OBJECTID_INFORMATION

FILE_FS_SIZE_INFORMATION

FILE_FS_VOLUME_INFORMATION

FltQueryVolumeInformationFile

IRP_MJ_QUERY_VOLUME_INFORMATION

IRP_MJ_SET_VOLUME_INFORMATION

Using Nt and Zw Versions of the Native System Services Routines

ZwCreateFile

ZwOpenFile

ZwQueryDirectoryFile

ZwQueryInformationFile

ZwSetInformationFile

ZwSetVolumeInformationFile

View the official Windows Driver Kit DDI reference

Edit description on GitHub

Windows Driver Kit DDI reference (nf-ntifs-ntqueryvolumeinformationfile)

NtQueryVolumeInformationFile function

Description

The NtQueryVolumeInformationFile routine retrieves information about the volume associated with a given file, directory, storage device, or volume.

Parameters

FileHandle [in]

A handle to a file object returned by NtCreateFile or NtOpenFile for an open file, directory, storage device, or volume for which volume information is being requested.

IoStatusBlock [out]

A pointer to an IO_STATUS_BLOCK structure that receives the final completion status and information about the query operation. For successful calls that return data, the number of bytes written to the FsInformation buffer is returned in the structure's Information member.

FsInformation [out]

A pointer to a caller-allocated buffer that receives the desired information about the volume. The structure of the information returned in the buffer is defined by the FsInformationClass parameter.

Length [in]

Size in bytes of the buffer pointed to by FsInformation. The caller should set this parameter according to the given FsInformationClass.

FsInformationClass [in]

Type of information to be returned about the volume. Set this member to one of the following FS_INFORMATION_CLASS enumeration values.

Value Meaning
FileFsAttributeInformation Return a FILE_FS_ATTRIBUTE_INFORMATION structure containing attribute information about the file system responsible for the volume.
FileFsControlInformation Return a FILE_FS_CONTROL_INFORMATION structure containing file system control information about the volume.
FileFsDeviceInformation Return a FILE_FS_DEVICE_INFORMATION structure containing device information for the volume.
FileFsDriverPathInformation Return a FILE_FS_DRIVER_PATH_INFORMATION structure containing information about whether a specified driver is in the I/O path for the volume. The caller must store the name of the driver into the FILE_FS_DRIVER_PATH_INFORMATION structure before calling NtQueryVolumeInformationFile.
FileFsFullSizeInformation Return a FILE_FS_FULL_SIZE_INFORMATION structure containing information about the total amount of space available on the volume.
FileFsObjectIdInformation Return a FILE_FS_OBJECTID_INFORMATION structure containing file system-specific object ID information for the volume. Note that this is not the same as the (GUID-based) unique volume name assigned by the operating system.
FileFsSizeInformation Return a FILE_FS_SIZE_INFORMATION structure containing information about the amount of space on the volume that is available to the user associated with the calling thread.
FileFsVolumeInformation Return a FILE_FS_VOLUME_INFORMATION containing information about the volume such as the volume label, serial number, and creation time.
FileFsSectorSizeInformation Return a FILE_FS_SECTOR_SIZE_INFORMATION structure that contains information about the physical and logical sector sizes of a volume.

Return value

NtQueryVolumeInformationFile returns STATUS_SUCCESS or an appropriate error status.

Remarks

NtQueryVolumeInformationFile retrieves information about the volume associated with a given file, directory, storage device, or volume.

If the FileHandle represents a direct device open, only FileFsDeviceInformation can be specified as the value of FsInformationClass.

NtQueryVolumeInformationFile returns zero in any member of a FILE_XXX_INFORMATION structure that is not supported by the file system.

For information about other file information query routines, see File Objects.

Minifilters should use FltQueryVolumeInformationFile instead of NtQueryVolumeInformationFile.

Callers of NtQueryVolumeInformationFile must be running at IRQL = PASSIVE_LEVEL and with special kernel APCs enabled.

[!NOTE] If the call to the NtQueryVolumeInformationFile function occurs in user mode, you should use the name "NtQueryVolumeInformationFile" instead of "ZwQueryVolumeInformationFile".

For calls from kernel-mode drivers, the Nt*Xxx* and Zw*Xxx* versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters. For more information about the relationship between the Nt*Xxx* and Zw*Xxx* versions of a routine, see Using Nt and Zw Versions of the Native System Services Routines.

See also

FILE_FS_ATTRIBUTE_INFORMATION

FILE_FS_CONTROL_INFORMATION

FILE_FS_DEVICE_INFORMATION

FILE_FS_DRIVER_PATH_INFORMATION

FILE_FS_FULL_SIZE_INFORMATION

FILE_FS_OBJECTID_INFORMATION

FILE_FS_SIZE_INFORMATION

FILE_FS_VOLUME_INFORMATION

FltQueryVolumeInformationFile

IRP_MJ_QUERY_VOLUME_INFORMATION

IRP_MJ_SET_VOLUME_INFORMATION

Using Nt and Zw Versions of the Native System Services Routines

NtCreateFile

NtOpenFile

NtQueryDirectoryFile

NtQueryInformationFile

NtSetInformationFile

ZwSetVolumeInformationFile

View the official Windows Driver Kit DDI reference

Edit description on GitHub

Windows Driver Kit DDI reference (nf-ntifs-zwqueryvolumeinformationfile)

ZwQueryVolumeInformationFile function (ntifs.h)

Description

The ZwQueryVolumeInformationFile routine retrieves information about the volume associated with a given file, directory, storage device, or volume.

Parameters

FileHandle [in]

A handle to a file object returned by ZwCreateFile or ZwOpenFile for an open file, directory, storage device, or volume for which volume information is being requested.

IoStatusBlock [out]

A pointer to an IO_STATUS_BLOCK structure that receives the final completion status and information about the query operation. For successful calls that return data, the number of bytes written to the FsInformation buffer is returned in the structure's Information member.

FsInformation [out]

A pointer to a caller-allocated buffer that receives the desired information about the volume. The structure of the information returned in the buffer is defined by the FsInformationClass parameter.

Length [in]

Size in bytes of the buffer pointed to by FsInformation. The caller should set this parameter according to the given FsInformationClass.

FsInformationClass [in]

Type of information to be returned about the volume. Set this member to one of the following FS_INFORMATION_CLASS enumeration values.

Value Meaning
FileFsAttributeInformation Return a FILE_FS_ATTRIBUTE_INFORMATION structure containing attribute information about the file system responsible for the volume.
FileFsControlInformation Return a FILE_FS_CONTROL_INFORMATION structure containing file system control information about the volume.
FileFsDeviceInformation Return a FILE_FS_DEVICE_INFORMATION structure containing device information for the volume.
FileFsDriverPathInformation Return a FILE_FS_DRIVER_PATH_INFORMATION structure containing information about whether a specified driver is in the I/O path for the volume. The caller must store the name of the driver into the FILE_FS_DRIVER_PATH_INFORMATION structure before calling ZwQueryVolumeInformationFile.
FileFsFullSizeInformation Return a FILE_FS_FULL_SIZE_INFORMATION structure containing information about the total amount of space available on the volume.
FileFsObjectIdInformation Return a FILE_FS_OBJECTID_INFORMATION structure containing file system-specific object ID information for the volume. Note that this is not the same as the (GUID-based) unique volume name assigned by the operating system.
FileFsSizeInformation Return a FILE_FS_SIZE_INFORMATION structure containing information about the amount of space on the volume that is available to the user associated with the calling thread.
FileFsVolumeInformation Return a FILE_FS_VOLUME_INFORMATION containing information about the volume such as the volume label, serial number, and creation time.
FileFsSectorSizeInformation Return a FILE_FS_SECTOR_SIZE_INFORMATION structure that contains information about the physical and logical sector sizes of a volume.

Return value

ZwQueryVolumeInformationFile returns STATUS_SUCCESS or an appropriate error status.

Remarks

ZwQueryVolumeInformationFile retrieves information about the volume associated with a given file, directory, storage device, or volume.

If the FileHandle represents a direct device open, only FileFsDeviceInformation can be specified as the value of FsInformationClass.

ZwQueryVolumeInformationFile returns zero in any member of a FILE_XXX_INFORMATION structure that is not supported by the file system.

For information about other file information query routines, see File Objects.

Minifilters should use FltQueryVolumeInformationFile instead of ZwQueryVolumeInformationFile.

Callers of ZwQueryVolumeInformationFile must be running at IRQL = PASSIVE_LEVEL and with special kernel APCs enabled.

[!NOTE] If the call to the ZwQueryVolumeInformationFile function occurs in user mode, you should use the name "NtQueryVolumeInformationFile" instead of "ZwQueryVolumeInformationFile".

For calls from kernel-mode drivers, the Nt*Xxx* and Zw*Xxx* versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters. For more information about the relationship between the Nt*Xxx* and Zw*Xxx* versions of a routine, see Using Nt and Zw Versions of the Native System Services Routines.

See also

FILE_FS_ATTRIBUTE_INFORMATION

FILE_FS_CONTROL_INFORMATION

FILE_FS_DEVICE_INFORMATION

FILE_FS_DRIVER_PATH_INFORMATION

FILE_FS_FULL_SIZE_INFORMATION

FILE_FS_OBJECTID_INFORMATION

FILE_FS_SIZE_INFORMATION

FILE_FS_VOLUME_INFORMATION

FltQueryVolumeInformationFile

IRP_MJ_QUERY_VOLUME_INFORMATION

IRP_MJ_SET_VOLUME_INFORMATION

Using Nt and Zw Versions of the Native System Services Routines

ZwCreateFile

ZwOpenFile

ZwQueryDirectoryFile

ZwQueryInformationFile

ZwSetInformationFile

ZwSetVolumeInformationFile

View the official Windows Driver Kit DDI reference

Edit description on GitHub

NTinternals.net (undocumented.ntinternals.net)

This function is documented in Windows Driver Kit here, here, and here.

FileHandle

HANDLE to File Object.

IoStatusBlock

IO result of call.

FileSystemInformation

Caller's allocated buffer for output data.

Length

Length of FileSystemInformation buffer, in bytes.

FileSystemInformationClass

Information class described in FS_INFORMATION_CLASS topic.

NtQueryVolumeInformationFile gives information about volume (device) containing file specified as FileHandle parameter.

Documented by

See also

Edit description on GitHub