Click here to Skip to main content
13,193,468 members (46,627 online)
Rate this:
Please Sign up or sign in to vote.
See more: , +
For a project I'm assisting with I need to open the $MFT (the actual file) and calculate its MD5.
Windows does acknowledge its existence (i.e. Create file to \\.\c:\$mft works) but any attempt to read from it returns Access denied error.
tried a different approach with FSCTL_GET_RETRIEVAL_POINTERS, the call works but I couldn't find any code example on how to go over the file one cluster a time.
An NTFS Parser Lib[^] is a great project that can actually do what I want but it uses a GPL licence so I can't take code directly off it.
plus i think using it might be somewhat of an overkill anyway.
Any info would be welcomed.
Posted 7-Feb-11 5:45am
Updated 11-Jul-17 2:25am
Rate this: bad
Please Sign up or sign in to vote.

Solution 1

You will need to open the HDD (or better yet, just the partition) with direct access, then write your own file system library. You were pretty much doing this. Just use "\\\\.\\C:"

The good news is that this is not as hard as it sounds.

I would STRONGLY reccommend getting a hex editor. I use the excellent Breakpoint Hex Workshop[^] but it is not free. Try searching around for 1 that can open HDDs.

I would recommend that you get a basic understanding of the FAT filesystem first. Although the idea of NTFS is remarkably different the implementation of core features is almost identical for accessing the $FILEs such as $MFT.

There is a website[^] which I used for helping my understanding of the NTFS filesystem, although I already knew the FAT filesystem.

In addition. You can read parts of the NTFS Parser Lib that you mentioned, there is no harm in that, you just can't copy code from it.
Rate this: bad
Please Sign up or sign in to vote.

Solution 2

You can use this open source library:
NtfsReader .NET Library / Wiki / Home[^][^]

It is in C# language but is a good and simple library to work with NTFS file system.
jeron1 11-Jul-17 10:09am
Hopefully they've solved the last 6+ years.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

  Print Answers RSS
Top Experts
Last 24hrsThis month

Advertise | Privacy |
Web04 | 2.8.171018.2 | Last Updated 11 Jul 2017
Copyright © CodeProject, 1999-2017
All Rights Reserved. Terms of Service
Layout: fixed | fluid

CodeProject, 503-250 Ferrand Drive Toronto Ontario, M3C 3G8 Canada +1 416-849-8900 x 100