8/29/2008 9.0 Major Updated and revised the technical content. 10/24/2008 10.0 Major Updated and revised the technical content. 12/5/2008 11.0 Major Updated and revised the technical content. 1/16/2009 12.0 Major Updated and revised the technical content. 2/27/2009 13.0 Major Updated and revised the technical content. 4/10/2009 14.0 Major Updated and revised the technical content. 5/22/2009 15.0 Major Updated and revised the technical content. 7/2/2009 16.0 Major Updated and revised the technical content. 8/14/2009 17.0 Major Updated and revised the technical content. 9/25/2009 18.0 Major Updated and revised the technical content. 11/6/2009 19.0 Major Updated and revised the technical content. 12/18/2009 20.0 Major Updated and revised the technical content. 1/29/2010 21.0 Major Updated and revised the
technical content. 9/23/2011 30.2 Minor Clarified the meaning of the technical content. 12/16/2011 31.0 Major Updated and revised the technical content. 3/30/2012 32.0 Major Updated and revised the technical content. 7/12/2012 33.0 Major Updated and revised the technical content. 10/25/2012 34.0 Major Updated and revised the technical content. 1/31/2013 35.0 Major Updated and revised the technical content. 8/8/2013 36.0 Major Updated and revised the technical content. 11/14/2013 36.0 None No changes to the meaning, language, or formatting of the technical content. 2/13/2014 37.0 Major Updated and revised the technical content. 5/15/2014 37.0 None No changes to the meaning, language, or formatting of the technical content. 6/30/2015 38.0 Major Significantly changed the technical content.
10/16/2015 39.0 Major Significantly changed the technical content. 7/14/2016 40.0 Significantly changed the technical content. 6/1/2017 41.0 Major Significantly changed the technical content. 9/15/2017 42.0 Major Significantly changed the technical content.
specified in section . IO_REPARSE_TAG_HSM 0xC0000004 Obsolete. Used by legacy Hierarchical Storage Manager Product. IO_REPARSE_TAG_DRIVER_EXTENDER 0x80000005 Home server extender.<3> IO_REPARSE_TAG_HSM2 0x80000006 Obsolete. Used by legacy Hierarchical Storage Manager Product. IO_REPARSE_TAG_SIS 0x80000007 Used by filter driver. Server-side interpretation only, not meaningful over the wire. IO_REPARSE_TAG_DFS 0x8000000A Used by the DFS filter. The DFS is described in the Distributed File System (DFS): Referral Protocol Specification . Server-side interpretation only, not meaningful over the wire. IO_REPARSE_TAG_FILTER_MANAGER 0x8000000B Used by test harness.<4> IO_REPARSE_TAG_SYMLINK 0xA000000C Used for support. See section . IO_REPARSE_TAG_DFSR 0x80000012 Used by the DFS filter. The DFS is described in [MS-DFSC]. Server-side interpretation only, not
0 1 2 3 4 5 6 7 8 9 1 0 1 2 3 4 5 6 7 8 9 2 0 1 2 3 4 5 6 7 8 9 3 0 1 StartingVcn ... StartingVcn (8 bytes): A 64-bit signed integer that contains the virtual cluster number (VCN) at which to begin retrieving extents in the file. This value MUST be greater than or equal to 0. FSCTL_GET_RETRIEVAL_POINTERS Reply The FSCTL_GET_RETRIEVAL_POINTERS reply message returns the results of the as a variably–sized data element, RETRIEVAL_POINTERS_BUFFER, that specifies the allocation and location on disk of a specific file. The FSCTL_GET_RETRIEVAL_POINTERS reply returns the extent locations (that is, locations of allocated regions of disk space) of nonresident data. A file system MAY allow resident data, which is data that can be written to disk within the file's directory record. Because resident data requires no additional disk space allocation, no extent locations are associated with resident data.<23> The RETRIEVAL_POINTERS_BUFFER data element is as follows. 0 1 2 3 4 5 6 7 8 9 1 0 1 2 3 4 5 6 7 8 9 2 0 1 2 3 4 5 6 7 8 9 3 0 1 ExtentCount Unused StartingVcn ... Extents (variable) ... ExtentCount (4 bytes): A 32-bit unsigned integer that contains the number of data elements in the Extents array. This number can be zero if there are no allocated at (or beyond) the specified StartingVcn. Unused (4 bytes): Reserved for alignment. This field can contain any value and MUST be ignored. StartingVcn (8 bytes): A 64-bit signed integer that contains the starting returned by the FSCTL_GET_RETRIEVAL_POINTERS reply. This is not necessarily the VCN requested by the FSCTL_GET_RETRIEVAL_POINTERS request, as the file system driver might return the starting VCN of the extent containing the requested starting VCN. This value MUST be greater than or equal to 0. Extents (variable): An array of zero or more EXTENTS data elements. For the number of EXTENTS data elements in the array, see ExtentCount.
STATUS_INVALID_DEVICE_REQUEST 0xC0000010 The volume does not support integrity. FSCTL_SET_DEFECT_MANAGEMENT Request Sets the software defect management for the specified file associated with the handle on which this FSCTL was invoked. Used for UDF file systems. This message contains a FILE_SET_DEFECT_MGMT_BUFFER structure. FILE_SET_DEFECT_MGMT_BUFFER is defined as follows. 0 1 2 3 4 5 6 7 8 9 1 0 1 2 3 4 5 6 7 8 9 2 0 1 2 3 4 5 6 7 8 9 3 0 1 Disable Disable (1 byte): A value. If TRUE, indicates that defect management will be disabled. If FALSE, indicates that defect management will be enabled. This FSCTL is valid only on UDF file systems. All other file systems will treat this as an invalid FSCTL. For information regarding UDF, see . FSCTL_SET_DEFECT_MANAGEMENT Reply The only data item this message returns is a status code, as specified in section 2.3. The status code returned directly by the function that processes this FSCTL MUST be STATUS_SUCCESS or one of the following. code Meaning STATUS_INVALID_PARAMETER 0xC000000D An invalid parameter was passed to a service or function or the handle on which this FSCTL was invoked is that of a directory. STATUS_INVALID_DEVICE_REQUEST 0xC0000010 The specified request is not a operation for the target device. STATUS_SHARING_VIOLATION 0xC0000043 A file cannot be opened because the share access
0 1 2 3 4 5 6 7 8 9 1 0 1 2 3 4 5 6 7 8 9 2 0 1 2 3 4 5 6 7 8 9 3 0 1 Offset ... Length ... Offset (8 bytes): A 64-bit unsigned integer that contains a byte offset into the given file at which to start the trim request. Length (8 bytes): A 64-bit unsigned integer that contains the length, in bytes, of how much of the file to trim, starting at Offset. FSCTL_FILE_LEVEL_TRIM This message returns the results of the . The FILE_LEVEL_TRIM_OUTPUT data element follows. 0 1 2 3 4 5 6 7 8 9 1 0 1 2 3 4 5 6 7 8 9 2 0 1 2 3 4 5 6 7 8 9 3 0 1 NumRangesProcessed NumRangesProcessed (4 A 32-bit unsigned integer identifying the number of input ranges that were processed. This message returns a status code as specified in section 2.3. The status code returned directly by the function that processes this FSCTL MUST be STATUS_SUCCESS or one of the following. Error code Meaning STATUS_INVALID_PARAMETER 0xC000000D The given file is compressed or encrypted, or the size of the input buffer is smaller than the size of the FILE_LEVEL_TRIM data element, or no structures were given, or the output buffer is smaller than the size of FILE_LEVEL_TRIM_OUTPUT. STATUS_INVALID_DEVICE_REQUEST 0xC0000010 The file system does not support this operation. STATUS_INTEGER_OVERFLOW 0xC0000095 An operation on a parameter in the FSCTL_FILE_LEVEL_TRIM structure overflowed 64 bits. STATUS_NO_RANGES_PROCESSED 0xC0000460 The operation was successful, but no range was processed.
The target file is smaller than the logical sector size. The FileOffset field is not a multiple of the logical sector size of the volume. The CopyLength field is not a multiple of the logical sector size of the volume. The Size field is not equivalent to the size of an FSCTL_OFFLOAD_READ_INPUT data element. Adding the FileOffset and CopyLength fields results in the overflow of a 64-bit value. STATUS_OFFLOAD_READ_FILE_NOT_SUPPORTED 0xC000A2A3 Offload operations cannot be performed on: Compressed Files Sparse Files Encrypted Files File System Metadata Files STATUS_NOT_SUPPORTED 0xC00000BB The file system indicates that the volume does not support the operation. STATUS_OFFLOAD_READ_FLT_NOT_SUPPORTED 0xC000A2A1 A file system filter on the server has not opted in for Offload Read support. STATUS_FILE_DELETED 0xC0000123 The specified data is not valid. STATUS_FILE_CLOSED 0xC0000128 The specified file handle is closed. STATUS_END_OF_FILE 0xC0000011 The file read starts beyond the End Of the File (EOF).<68> STATUS_INSUFFICIENT_RESOURCES 0xC000009A There were insufficient resources to complete the operation. STATUS_BUFFER_TOO_SMALL 0xC0000023 The buffer is too small to contain an FSCTL_OFFLOAD_READ_INPUT data element. or The output buffer is too small to contain an FSCTL_OFFLOAD_READ_OUTPUT data element.
The CopyLength is not a multiple of the logical sector size of the volume. The TransferOffset field is not a multiple of the logical sector size of the volume. The FileOffset field is greater than the Valid Data Length (VDL) for the file. The Size field is not equivalent to the size of an FSCTL_OFFLOAD_WRITE_INPUT data element. Adding the FileOffset and CopyLength fields results in the overflow of a 64-bit value. STATUS_OFFLOAD_WRITE_FILE_NOT_SUPPORTED 0xC000A2A4 Offload operations cannot be performed on: Compressed Files Sparse Files Encrypted Files File System Metadata Files STATUS_NOT_SUPPORTED 0xC00000BB The file system indicates that the volume does not support the operation. STATUS_OFFLOAD_WRITE_FLT_NOT_SUPPORTED 0xC000A2A2 A file system filter on the server has not opted in for Offload Write support. STATUS_FILE_DELETED 0xC0000123 The specified data was not valid. STATUS_FILE_CLOSED 0xC0000128 The specified file handle is closed. STATUS_END_OF_FILE 0xC0000011 The file offset for the write is beyond the End Of the File (EOF). STATUS_MEDIA_WRITE_PROTECTED 0xC00000A2 The volume is read only. STATUS_INSUFFICIENT_RESOURCES 0xC000009A were insufficient resources to complete the operation. STATUS_BUFFER_TOO_SMALL 0xC0000023 The buffer is too small to contain an FSCTL_OFFLOAD_WRITE_INPUT data element. or
0 1 2 3 4 5 6 7 8 9 1 0 1 2 3 4 5 6 7 8 9 2 0 1 2 3 4 5 6 7 8 9 3 0 1 NextEntryOffset FileIndex CreationTime ... LastAccessTime ... LastWriteTime ... ChangeTime ... EndOfFile ... AllocationSize ... FileAttributes FileNameLength FileId ... LockingTransactionId (16 ... ... TxInfoFlags FileName (variable) ...
STATUS_INVALID_PARAMETER 0xC000000D The file specified is not a valid parameter. STATUS_NO_SUCH_FILE 0xC000000F The file does not STATUS_NO_MORE_FILES 0x80000006 No more were found which match the file specification. STATUS_BUFFER_OVERFLOW 0x80000005 The output buffer was filled before all of the ObjectID information could be returned. Only complete FILE_OBJECTID_INFORMATION structures are returned. FILE_OBJECTID_INFORMATION_TYPE_1 A FILE_OBJECTID_INFORMATION_TYPE_1 data element is as follows. 0 1 2 3 4 5 6 7 8 9 1 0 1 2 3 4 5 6 7 8 9 2 0 1 2 3 4 5 6 7 8 9 3 0 1 FileReferenceNumber ... ObjectId (16 bytes) ... ... BirthVolumeId (16 bytes) ... ... BirthObjectId (16 ... ... DomainId (16 bytes) ... ...
0xC0000023 information has been written to the buffer. FILE_GET_QUOTA_INFORMATION This structure is used to provide the list of for which quota query information is requested. When multiple FILE_GET_QUOTA_INFORMATION data elements are present in the buffer, each MUST be aligned on a 4-byte boundary. Any bytes inserted for alignment SHOULD be set to zero, and the receiver MUST ignore them. No padding is required following the last data element. A FILE_GET_QUOTA_INFORMATION data element is as follows. 0 1 2 3 4 5 6 7 8 9 1 0 1 2 3 4 5 6 7 8 9 2 0 1 2 3 4 5 6 7 8 9 3 0 1 NextEntryOffset SidLength Sid (variable) ... NextEntryOffset (4 bytes): A 32-bit unsigned integer that contains the byte offset from the beginning of this entry, at which the next FILE_GET_QUOTA_INFORMATION entry is located, if multiple entries are present in a buffer. This member MUST be zero if no other entries follow this one. An implementation MUST use this value to determine the location of the next entry (if multiple entries are present in a buffer). SidLength (4 bytes): A 32-bit unsigned integer that contains the length, in bytes, of the Sid data element. Sid (variable): SID for this user. SIDs are sent in little-endian format and require no padding. The format of a SID is as specified in section 2.4.2.2. FileRenameInformation This information class is used to rename a file. The data element provided by the client takes one of two forms, depending on whether it is embedded within SMB or SMB2. The structure definitions are as follows: FILE_RENAME_INFORMATION_TYPE_1 for the SMB protocol (section ). FILE_RENAME_INFORMATION_TYPE_2 for the SMB2 protocol (section ). This operation returns a status code, as specified in section 2.3. The status code returned directly by the function that processes this file information class MUST be STATUS_SUCCESS or one of the following. Error code Meaning
FILE_REMOTE_DEVICE 0x00000010 Indicates that the volume is for a remote file system like SMB or CIFS. FILE_DEVICE_IS_MOUNTED 0x00000020 Indicates that a file system is mounted on the device. FILE_VIRTUAL_VOLUME 0x00000040 Indicates that the volume does not directly reside on storage media, but resides on some other type of media (memory for example). FILE_DEVICE_SECURE_OPEN 0x00000100 By default, volumes do not check the ACL associated with the volume, but instead use the ACLs associated with individual files on the volume. When this flag is set the volume ACL is also checked. FILE_CHARACTERISTIC_TS_DEVICE 0x00001000 Indicates that the device object is part of a Terminal Services device stack. See for more information. FILE_CHARACTERISTIC_WEBDAV_DEVICE 0x00002000 Indicates that a web-based Distributed Authoring and Versioning (WebDAV) file system is mounted on the device. See for more information. FILE_DEVICE_ALLOW_APPCONTAINER_TRAVERSAL 0x00020000 The IO Manager normally performs a full security check for traverse access on every file open when the client is an appcontainer. Setting of this flag bypasses this enforced traverse access check if the client token already has traverse privileges.<160> FILE_PORTABLE_DEVICE 0x0004000 Indicates that the given device resides on a portable bus like USB or Firewire and that the entire device (not just the media) can be removed from the system. This operation returns a status code, as specified in section 2.3. The status code returned directly by the function that processes this file information class MUST be STATUS_SUCCESS or one of the following. Error code Meaning STATUS_INFO_LENGTH_MISMATCH 0xC0000004 The specified information record length does not match the length that is required for the specified information class.
0x00000400 FILE_ATTRIBUTE_SPARSE_FILE 0x00000200 A file that is a . FILE_ATTRIBUTE_SYSTEM 0x00000004 A file or directory that the operating system uses a part of or uses exclusively. FILE_ATTRIBUTE_TEMPORARY 0x00000100 A file that is being used for temporary storage. The operating system can choose to store this file's data in memory rather than on mass storage, writing the data to mass storage only if data remains in the file when the file is closed. FILE_ATTRIBUTE_INTEGRITY_STREAM 0x00008000 A file or directory that is configured with integrity support. For a file, all data streams in the file have integrity support. For a directory, integrity support is the default for newly created files and subdirectories, unless the caller specifies otherwise.<162> FILE_ATTRIBUTE_NO_SCRUB_DATA 0x00020000 A file or directory that is configured to be excluded from the data integrity scan. For a directory configured with FILE_ATTRIBUTE_NO_SCRUB_DATA, the default for created files and subdirectories is to inherit the FILE_ATTRIBUTE_NO_SCRUB_DATA attribute.<163> Directory Change Notifications The following definitions are part of the Directory Change Notification algorithm defined in section 2.1.5.10. FILE_NOTIFY_INFORMATION The FILE_NOTIFY_INFORMATION structure contains the changes for which the client is being notified. The structure consists of the following. 0 1 2 3 4 5 6 7 8 9 1 0 1 2 3 4 5 6 7 8 9 2 0 1 2 3 4 5 6 7 8 9 3 0 1 NextEntryOffset Action FileNameLength FileName (variable)
GPT_BASIC_DATA_ATTRIBUTE_READ_ONLY 0x1000000000000000 The volume is read-only. GPT_BASIC_DATA_ATTRIBUTE_SHADOW_COPY 0x2000000000000000 The volume is a shadow copy of another volume. GPT_BASIC_DATA_ATTRIBUTE_HIDDEN 0x4000000000000000 The volume is hidden. GPT_BASIC_DATA_ATTRIBUTE_NO_DRIVE_LETTER 0x8000000000000000 The volume is not assigned a default drive letter.
Index A 41 24 15 B 40 27 C 195 77 170 27 16 D Data elements 26 22 24 16 27 16 81 Details 16 E 173 43 54 F 42 Fields 16 15 15 167 98 154 100 102 103 117 145 90 91 90 119 132 26 26 168 22 22 23 137 138 142 143 65 146 147 78 100 103 104 104 105 106 108 110 112 112 113 154 157 165 159 159 160 161 162 163 164 114 116 118 119 122 124 127 FileLinkInformation packet ( 128, 128, 129) 130 131 133 133 134 136 138 139 142 145 147 148 149 150 151 152 33 153 27 29 29 30
30 30 30 31 33 33 45 44 45 46 46 46 51 51 49 49 49 52 52 53 52 55 54 57 55 91 92 95 96 58 58 58 61 60 60 59 62 61 63 63 64 63 66 66 68 68 69 69 75 75 76 76 79 78 80 79 82 81 83 83 84 83 85 84 86 85 85 86 86 87 87 88 87 89 89 G 9 I 174 174 Information classes 98 154 13 9 171 170 171 171 L 15 M 40 41 39 20 N Names 24 26 13 21 35 46 O 14 14 P 174 174 24 180 R