2.2.7.2.2.1 FSCTL_SRV_ENUMERATE_SNAPSHOTS Response
The FSCTL_SRV_ENUMERATE_SNAPSHOTS response format is a special case of the NT_TRANSACT_IOCTL subcommand. Only the FSCTL_SRV_ENUMERATE_SNAPSHOTS response specifics are described here.
SMB_Parameters
-
WordCount (1 byte): This field MUST be set to 0x16.
-
SetupCount (1 byte): The number of setup words that are included in the transaction response. The value MUST be set to 0x04.
-
Setup (8 bytes): This field contains the following:
-
Function(2 bytes): The transaction subcommand code, which is used to identify the operation performed by the server. The value MUST be set to 0x0002.
-
FunctionCode (4 bytes): This field MUST be set to 0x00144064.
-
FID (2 bytes): This field MUST contain a File ID representing the open of a file for which snapshots are requested.
-
NT_Trans_Parameters
No NT Trans parameters are sent in this response.
NT_Trans_Data
-
NT_Trans_Data { ULONG NumberOfSnapShots; ULONG NumberOfSnapShotsReturned; ULONG SnapShotArraySize; WCHAR SnapShotMultiSZ[]; }
|
|
|
|
|
|
|
|
|
|
1 |
|
|
|
|
|
|
|
|
|
2 |
|
|
|
|
|
|
|
|
|
3 |
|
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
NumberOfSnapShots |
|||||||||||||||||||||||||||||||
|
NumberOfSnapShotsReturned |
|||||||||||||||||||||||||||||||
|
SnapShotArraySize |
|||||||||||||||||||||||||||||||
|
SnapShotMultiSZ (variable) |
|||||||||||||||||||||||||||||||
|
... |
|||||||||||||||||||||||||||||||
NumberOfSnapShots (4 bytes): The number of snapshots that the underlying object store contains of this file.
NumberOfSnapShotsReturned (4 bytes): This value MUST be the number of snapshots that are returned in this response. If this value is less than NumberofSnapshots, then there are more snapshots than were able to fit in this response.
SnapShotArraySize (4 bytes): The length, in bytes, of the SnapShotMultiSZ field.
SnapShotMultiSZ (variable): A concatenated list of available snapshots. Each snapshot MUST be encoded as a NULL-terminated sequence of 16-bit Unicode characters, and MUST take on the following form: @GMT-YYYY.MM.DD-HH.MM.SS. The concatenated list MUST be terminated by one additional 16-bit Unicode NULL character. If the response contains no snapshots, then the server MUST set this field to two 16-bit Unicode NULL characters.