Determine case sensitivity of a Windows volume in kernel mode

Question

The Windows API supports a GetVolumeInformation function. This function provides information about a Windows volume. Specifically, it returns a FILE_CASE_SENSITIVE_SEARCH switch. In the kernel there are FltQueryVolumeInformation and ZwQueryVolumeInformationFile, but I don't see any way to derive the case sensitivity information from the available information classes.

Am I correct in understanding that the FILE_CASE_SENSITIVE_SEARCH switch only specifies that a case sensitive search is possible (not that it is done by default)? Is it correct that you only know about case sensitivity based on the way the file is opened (i.e. you must call CreateFile with the FILE_FLAG_POSIX_SEMANTICS flag, otherwise Win32 case-insensitive behavior is used)?

Answer 1

Ok, I ask this question on MSDN and found the answer

Somehow I missed that FILE_FS_ATTRIBUTE_INFORMATION information class attribute will allow ZwQueryVolumeInformationFile and FltQueryVolumeInformation functions to return a struct that contains a FileSystemAttributes field with various bit flags including FILE_CASE_PRESERVED_NAMES and FILE_CASE_SENSITIVE_SEARCH.

This only shows that the volume will support case sensitive name searches (not that it defaults to it). You still need to use the FILE_FLAG_POSTIX_SEMANTICS flag on CreateFile to take advantage of case sensitivity. There also appears to be a registry setting to make this the default (you can google/bing that).