Question

The MSDN page on FILE_OBJECT says:

“Note The type of object (for example, a file, directory, or volume)
that a given file object represents cannot be determined by only
examining the contents of the file object structure. For information
about how to determine the type of object that a file object
represents, see ZwQueryInformationFile.”

I have two questions:

1, How to determine the object type through ZwQueryInformationFile?

2, Is DEVICE_TYPE, such as FILE_DEVICE_CD_ROM_FILE_SYSTEM, FILE_DEVICE_DISK_FILE_SYSTEM, FILE_DEVICE_FILE_SYSTEM, reliable to determine?

Thanks.

Answer 1

If you are implementing minifilter, may be you can use FltQueryInformationFile with FILE_INFORMATION_BASIC to get file attributes. Then check for FILE_ATTRIBUTE_DEVICE attribute.