FILE_BASIC_INFORMATION structure (wdm.h)

The FILE_BASIC_INFORMATION structure contains timestamps and basic attributes of a file. It is used as an argument to routines that query or set file information.

Syntax

typedef struct _FILE_BASIC_INFORMATION {
  LARGE_INTEGER CreationTime;
  LARGE_INTEGER LastAccessTime;
  LARGE_INTEGER LastWriteTime;
  LARGE_INTEGER ChangeTime;
  ULONG         FileAttributes;
} FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;

Members

CreationTime

Specifies the time that the file was created.

LastAccessTime

Specifies the time that the file was last accessed.

LastWriteTime

Specifies the time that the file was last written to.

ChangeTime

Specifies the last time the file was changed.

FileAttributes

Specifies one or more FILE_ATTRIBUTE_XXX flags. For descriptions of these flags, see File Attribute Constants in the Microsoft Windows SDK.

Remarks

The FILE_ATTRIBUTE_NORMAL flag cannot be set or returned in combination with any other attributes. All other FileAttributes values override this attribute.

Time values CreationTime, LastAccessTime, LastWriteTime, and ChangeTime are expressed in absolute system time format. Absolute system time is the number of 100-nanosecond intervals since the start of the year 1601 in the Gregorian calendar.

If you specify a value of zero for any of the XxxTime members of the FILE_BASIC_INFORMATION structure, the ZwSetInformationFile function keeps a file's current setting for that time.

The file system updates the values of the LastAccessTime, LastWriteTime, and ChangeTime members as appropriate after an I/O operation is performed on a file. A driver or application can request that the file system not update one or more of these members for I/O operations that are performed on the caller's file handle by setting the appropriate members to -1. The caller can set one, all, or any other combination of these three members to -1. Only the members that are set to -1 will be unaffected by I/O operations on the file handle; the other members will be updated as appropriate. On NTFS and ReFS systems, time stamp updates on the file handle can be restored by setting the appropriate member(s) to -2.

To set the members of this structure, the caller must have FILE_WRITE_ATTRIBUTES access to the file.

Requirements

See also

KeQuerySystemTime

ZwCreateFile

ZwQueryInformationFile

ZwSetInformationFile