PROCESS_DISK_COUNTERS

The PROCESS_DISK_COUNTERS structure holds information whose collection can be managed by such exported functions PsIsDiskCountersEnabled and PsUpdateDiskCounters. A pointer to the counters is held in each EPROCESS and can be extracted to a SYSTEM_PROCESS_INFORMATION_EXTENSION through the ZwQuerySystemInformation function.

The PROCESS_DISK_COUNTERS is 0x28 bytes in both 32-bit and 64-bit Windows.

ULONGLONG BytesRead;

ULONGLONG BytesWritten;

ULONGLONG ReadOperationCount;

ULONGLONG WriteOperationCount;

ULONGLONG FlushOperationCount;