// ntifs.h

typedef struct _QUERY_ON_CREATE_EA_INFORMATION {
  ULONG                     EaBufferSize;
  PFILE_FULL_EA_INFORMATION EaBuffer;
} QUERY_ON_CREATE_EA_INFORMATION, *PQUERY_ON_CREATE_EA_INFORMATION;
View the official Windows Driver Kit DDI reference

NtDoc

No description available.

Edit description on GitHub

Windows Driver Kit DDI reference (ns-ntifs-query_on_create_ea_information)

Description

The QUERY_ON_CREATE_EA_INFORMATION structure is used to write file information when FltRequestFileInfoOnCreateCompletion is called with the QoCFileEaInformation flag set in the InfoClassFlags parameter.

Members

`EaBufferSize`

Size, in bytes, of the buffer that EaBuffer points to.

`EaBuffer`

A list of FILE_FULL_EA_INFORMATION structures with extended attribute (EA) information.

Remarks

The file system allocates this structure and fills in the requested information, if supported, while it processes a file create. Filter Manager will free the allocated structure.

QUERY_ON_CREATE_EA_INFORMATION - NtDoc