Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
File objects function as the logical interface between kernel and user-mode processes and the file data that resides on the physical disk. A file object contains both the data written to the file and the following set of kernel-maintained attributes.
| Information type | Purpose |
|---|---|
| File name | Names the corresponding physical file. |
| Current byte offset | Used in synchronous file I/O (described later in this section) to identify the current starting location of read and write operations. |
| Share mode | Specifies whether a second process can open a file for read, write, or delete access while the initial process is still accessing it. |
| I/O mode | Specifies whether the initial process opened the file for synchronous or asynchronous I/O, cached or uncached I/O, sequential or random I/O, and so on. |
| Pointer to device object | Identifies the physical device the file data resides on. |
| Pointer to the volume parameter block, or VPB | Identifies the volume or partition the file data resides on. |
| Pointer to section object pointers | Identifies a root structure that describes a mapped file. |
| Pointer to private cache map | Identifies the file data that is currently cached. |
These attributes are defined as part of the FILE_OBJECT structure in Ntddk.h. Refer to the definition of this structure in the Windows Driver Kit (WDK) documentation for the data lengths and types of the values.