The KSPROPERTY_CLOCK_CORRELATEDTIME property is passed a KSCORRELATED_TIME structure, which is filled in with the current time and system time.
typedef struct {
LONGLONG Time;
LONGLONG SystemTime;
} KSCORRELATED_TIME, *PKSCORRELATED_TIME;
Declared in ks.h. Include ks.h.
The system time is acquired from KeQueryPerformanceCounter. Note that the performance counter is not suspended when the machine is suspended, so that correlations change when the machine goes through a suspend.