Click here to Skip to main content
15,885,365 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
If I have an NTFS File ID, is there an official way to get the file names from that file ID? (Other then scanning every file on the hard drive...?)

It appears that I can at least verify that a file ID is valid by calling NtCreateFile, although Microsoft's documentation has a big fat warning that the API is subject to change.
Posted
Updated 21-Jul-18 18:42pm

OK, just taking a stab at it, could you use OpenFileById OpenFileById [^]to get you a handle, then GetFileInformationByHandleEx [^]to return a FILE_NAME_INFO[^]structure?

I would have thought there would be a way to get the name directly from the ID, but perhaps that capability is missing because FileIDs are re-used by the system so the same ID won't always point to the same file as time passes. If the system is static (read-only) this won't be a problem, but it still probably isn't a good practice.
 
Share this answer
 
On NTFS the $MFT file itself has an entry for every file. The FileId has 16 bits of sequence number and 48-bits of $MFT file index. FileId => [seq << 48 | mft_index]. You can read $MFT records using
DeviceIoControl(hVolume, FSCTL_GET_NTFS_FILE_RECORD, ...)
to obtain
NTFS_FILE_RECORD_OUTPUT_BUFFER
and access its
FileRecordBuffer
member which the NTFS info for the fileId in the
FileReferenceNumber
parameter of the
NTFS_FILE_RECORD_OUTPUT_BUFFER
matching the
NTFS_FILE_RECORD_INPUT_BUFFER
unless the fileId is invalid.

The MFT is fairly well documented in many places on the web. That said, it is important to note that an MFT FILE-RECORD contains key-value pairs of attributes. Among the things in those attributes are the hardlink names, any reparse-point, and any NTFS streams (like a dir) that are part of that file.

Put another way, a given fileId can refer to multiple "file names" if it has multiple hardlinks pointing to it. So the canonical name is the first hardlink found in the key-value attributes of the $MFT record, which is then walked backward/up through the parent directory tree to build the canonical path to the file.
 
Share this answer
 
v7

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900