I wonder what return code you're getting?

okay. i get 87 as a result, which means: The parameter is incorrect.

now i tried the following:

sub query_users {
    my ( $self, $filename ) = @_;

    my $func =
      import_api( 'advapi32', 'QueryUsersOnEncryptedFile', 'PP', 'N' )
+;        
    die "Could not import API QueryUsersOnEncryptedFile: $!"
      unless defined $func;
      
    $filename = make_unicode( File::Spec->canonpath($filename) );   
    print "filename: $filename\n";

    my $encCertHashList = Win32::API::Struct->new( 'ENCRYPTION_CERTIFI
+CATE_HASH_LIST' );     
    print "retval: " . $func->Call( $filename, $encCertHashList) . "\n
+";        
    print $encCertHashList->{nCert_Hash}, "\n";
    
    $encCertHashList = Win32::API::Struct->new( 'ENCRYPTION_CERTIFICAT
+E_HASH_LIST' );     
    print "retval: " . $func->Call( $filename, \$encCertHashList) . "\
+n";
    print $encCertHashList->{nCert_Hash}, "\n";
    
    $encCertHashList = " " x 1024;
    print "retval: " . $func->Call( $filename, $encCertHashList) . "\n
+";
    print $encCertHashList, "\n";
    
    $encCertHashList = " " x 1024;
    print "retval: " . $func->Call( $filename, \$encCertHashList) . "\
+n";    
    print $encCertHashList, "\n";        
}
[download]

as a result i get

filename: C : \ e f s . p l
retval: 0
Use of uninitialized value in print at C:/Perl/site/lib/Win32/Security
+/EFS.pm line 180, <DATA> line 164.

retval: 0
Use of uninitialized value in print at C:/Perl/site/lib/Win32/Security
+/EFS.pm line 184, <DATA> line 164.

retval: 0
@¤&#9830;








retval: 0
[download]

in this case, the call works. but the structure is not really filled.
btw. the file is encrypted!

I'm getting much the same results. No errors, just nothing returned in the buffer :(

I'm using the C source code from here as a reference. Maybe it will give you some clues I'm not seeing?

I'll update if I have any success.

---

Examine what is said, not who speaks -- Silence betokens consent -- Love the truth but pardon error.

Lingua non convalesco, consenesco et abolesco. -- Rule 1 has a caveat! -- Who broke the cabal?

"Science is about questioning the status quo. Questioning authority".

In the absence of evidence, opinion is indistinguishable from prejudice.