What is the difference between NtFsControlFile() and DeviceIoControl() functions?

Question

Are there any places where one is preferable to another? Is there a performance impact to using one over the other?

Answer 1

I have no idea about implementation, but NtFsControlFile is an undocumented kernel internal and it's use comes with the risk that it will disappear/change implementation at some point in the future, whereas DeviceIoControl is part of the public Win32 API.

Answer 2

@Alex K.: Small remark: NtFsControlFile is documented in http://msdn.microsoft.com/en-us/library/ff566462(v=VS.85).aspx. Kernel mode application should use ZwFsControlFile function and user mode application can use NtFsControlFile.

@vedang: From you question I would assume that you don't a developer of kernel mode driver. So I will strictly recommend you to use only DeviceIoControl to send FSCTL_XXX codes http://msdn.microsoft.com/en-us/library/aa364230(v=VS.85).aspx.

Only if you plan to write an application which don't use Win32 subsystem and use NT native subsystem only like a small checkdisk application or disk defragmentation application which run at the beginning of the windows start (see session manager registry key) than you will have advantage in using of NtFsControlFile. In all cases of usual work you should use only DeviceIoControl.