Click here to Skip to main content
15,909,827 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
this is code that found MFTOffset and other information.

C#
uint nread = 0;
           IntPtr handle;
           byte[] buff = new byte[1024];
           string driveRoot = string.Concat("\\\\.\\", driveLetter);
           IntPtr hRoot = CreateFile(driveRoot,
               GENERIC_READ | GENERIC_WRITE,
               FILE_SHARE_READ | FILE_SHARE_WRITE,
               IntPtr.Zero,
               OPEN_EXISTING,
               FILE_ATTRIBUTE_NORMAL,
               IntPtr.Zero);
           if (hRoot != IntPtr.Zero)
                ReadFile(hRoot, buff, 1024,out nread, IntPtr.Zero);
           string SystemFile = Convert.ToString(LittleEndian(4, new byte[] { buff[3], buff[4], buff[5], buff[6] }, typeof(string)));
           int BytePerSector = 0;
           int SectorPerCluster = 0;
           double MFTStart = 0;
           if (SystemFile == "NTFS")
           {
               listBox1.Items.Add(SystemFile);

               BytePerSector = (int)LittleEndian(2, new byte[] { buff[11], buff[12] }, BytePerSector.GetType());
               listBox1.Items.Add("Byte per Sector : " + BytePerSector);

               SectorPerCluster = (int)LittleEndian(1, new byte[] { buff[13] }, typeof(int));
               listBox1.Items.Add("Sector per Cluster : " + SectorPerCluster.ToString());

               MFTStart = (long)LittleEndian(8, new byte[]{
                   buff[48],buff[49],buff[50],buff[51],buff[52],buff[53],buff[54],buff[55]}, typeof(long));
               listBox1.Items.Add("MFT LCN : " + MFTStart);

           }
           else
               listBox1.Items.Add("No NTFS Valoume");

I wanna read MFT.I found its offset on partition.i got partition handle with CreateFile API then i got MFT offset from MBR with ReadFile API.i compared result with WinHex and result was correct.now i wanna move to mft address on partition.i found SetFilePointer API to do it.could u send me correct code to move MFT offset??
i used SetFilePointer but i got error while use ReadFile(newAddress)

C#
public static void ReadMFT(string DriveLetter, ulong MFTStart, int bytepersector, int sectorpercluster)
        {
            IntPtr handle = IntPtr.Zero;
            IntPtr newaddress = IntPtr.Zero;
            long MFTAddress = bytepersector * sectorpercluster * (long)MFTStart;
            string driveRoot = string.Concat("\\\\.\\", DriveLetter);
            IntPtr hRoot = CreateFile(driveRoot,
                GENERIC_READ | GENERIC_WRITE,
                FILE_SHARE_READ | FILE_SHARE_WRITE,
                IntPtr.Zero,
                OPEN_EXISTING,
                FILE_ATTRIBUTE_NORMAL,
                IntPtr.Zero);

            newaddress = SetFilePointer(hRoot, (ulong)MFTAddress, IntPtr.Zero, 0);
            Console.WriteLine("hroot : " + hRoot.ToString());
            Console.WriteLine("MFTAddress : " + MFTAddress.ToString());
            Console.WriteLine("NewAddress : " + newaddress.ToString());
            if (hRoot.ToInt64() != INVALID_HANDLE_VALUE)
            {
                uint nread;
                byte[] buff = new byte[1024];
                if (ReadFile(newaddress, buff, (uint)buff.Length, out nread, IntPtr.Zero))
                    Console.WriteLine("Read successful");
                else
                    Console.WriteLine("Read unsuccessful");

            }
            while (true)
            {
                //read other MFT Record
                break;
            }
        }
Posted

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900