Gelöst: Vierten Zeitstempel ermitteln

[Garfield]

Code:

typedef struct _FILE_BASIC_INFORMATION {

LARGE_INTEGER CreationTime;
LARGE_INTEGER LastAccessTime;
LARGE_INTEGER LastWriteTime;
LARGE_INTEGER ChangeTime;
ULONG FileAttributes;

} FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;

Code:

typedef struct _FILE_BOTH_DIR_INFORMATION {

ULONG NextEntryOffset;
ULONG FileIndex;
LARGE_INTEGER CreationTime;
LARGE_INTEGER LastAccessTime;
LARGE_INTEGER LastWriteTime;
LARGE_INTEGER ChangeTime;
LARGE_INTEGER EndOfFile;
LARGE_INTEGER AllocationSize;
ULONG FileAttributes;
ULONG FileNameLength;
ULONG EaSize;
BYTE ShortNameLength;
WCHAR ShortName[12];
WCHAR FileName[1];

} FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;

Code:

NtQueryInformationFile(

IN HANDLE FileHandle,
OUT PIO_STATUS_BLOCK IoStatusBlock,
OUT PVOID FileInformation,
IN ULONG Length,
IN FILE_INFORMATION_CLASS FileInformationClass );

http://undocumented.ntinternals.net/

[edit=SirThornberry]quote-tags zu c-tags geändert - Bitte künftig die entsprechenden Tags verwenden - Mfg, SirThornberry[/edit]