CODEWITHSUNDEEP
windowsfileiohandle
Mtm 3.14
Mtm 3.14

Reputation: 29

Has been a file handle opened with FILE_FLAG_SEQUENTIAL_SCAN flag?

There are multiple flags and attributes (dwFlagsAndAttributes) that can be used while a file is opened with CreateFile() call. One of such flags is FILE_FLAG_SEQUENTIAL_SCAN. I am wondering, is it possible to somehow detect/guess whether a file handle has been created using this flag if the only thing you have is the handle itself and no information about its CreateFile parameters is available?

Upvotes: 1

Views: 361

Answers (1)

IInspectable
IInspectable

Reputation: 51489

You can call NtQueryInformationFile (or ZwQueryInformationFile from kernel mode) to retrieve a FILE_OBJECT structure. Its Flags member provides the information you are looking for.

Upvotes: 3

Related Questions