QueryInformationVolume PML Operations

All of these operations belong to opcode=3,30 and correspond to the different values of FsInformationClass in the Microsoft documentation for NtQueryVolumeInformationFile.

Although Procmon does not show it, the FsInformationClass is in the PML data at evdata[0] (see PML Binary Data and Results Offsets) and is provided by viewer9 in the FsInfoClass field. Not all of these operations have their evresults parsed into fields in viewer9, so for rare ones you can look up the evresults structure in the Microsoft documentation for NtQueryVolumeInformationFile.

In addition to FsInfoClass, a 32-bit BufferSize and hex Buffer address (neither shown in Procmon) are extracted from the data to give insights into the way the underlying API was called.

To find QueryInformationVolume PML operations not explicitly named with Op in viewer9, query opcode=3,30 FsInfoClass=FileXYZInformation.

QueryAttributeInformationVolume

FsInfoClass is FileFsAttributeInformation. FileSysAttr contains bit flags corresponding to Microsoft documentation for lpFileSystemFlags. MaxCompNameLen (aka "Maximum Component Name Length") is a 32-bit integer. FileSysName is the string name.

QueryControlInformationVolume

FsInfoClass is FileFsControlInformation. This operation returns 5 64-bit integers FreeSpaceStartFiltering, FreeSpaceThreshold, FreeSpaceStopFiltering, DefaultQuotaThreshold, DefaultQuotaLimit, and a bit flags field FileSystemControlFlags though the flags are not enumerated in viewer9 (e.g. FILE_VC_LOG_QUOTA_THRESHOLD, not to be confused with FsControl codes in FileSystemControl PML Operation) all explained in the Microsoft documentation for FILE_FS_CONTROL_INFORMATION.

QueryDeviceInformationVolume

FsInfoClass is FileFsDeviceInformation. DeviceType is an enumerated name for the type of device. Characteristics are bit flags for device characteristics.

QueryFullSizeInformationVolume

FsInfoClass is FileFsFullSizeInformation. There are five 32-bit integers: TotalAlloc, CallerAvail, ActualAvail, SectorsPerAlloc, BytesPerSector.

QueryInformationVolume

FsInfoClass is FileFsVolumeInformation. VolCreationTime is a timestamp. VolSerialNo is stored as a 32-bit integer but displayed as two 16-bit hex numbers separated by a dash. SupportsObjects is a 1-byte boolean. VolLabel is a string.

QueryObjectIdInformationVolume

FsInfoClass is FileFsObjectIdInformation. ObjectId is a 16-byte hex string 32 characters long.

QuerySizeInformationVolume

FsInfoClass is FileFsSizeInformation. There are four 32-bit integers: TotalAlloc, AvailAlloc, SectorsPerAlloc, BytesPerSector.

Example of QueryInformationVolume from 64-bit PML

Hover over field values like Time, ResultCode, VolCreationTime, and bytes of evdata and evresults in this example to see tooltips as they appear in viewer9. The tooltip of the first byte of a color patch tells the field name.

In some cases, viewer9 uses different field names than Procmon. In addition to those already mentioned in this article, other different Procmon field names are ActualAvailableAllocationUnits, CallerAvailableAllocationUnits, FileSystemAttributes, FileSystemName, MaximumComponentNameLength, SectorsPerAllocationUnit, TotalAllocationUnits, VolumeCreationTime, VolumeLabel, and VolumeSerialNumber.

See also

• PML Binary Data and Results Offsets
• PML Operations
• FileSystemControl PML Operation