How to get offset of volume?

Is it possile to get for a file seek position there corresponding offset
into the drive volume?

Maxim
Fri Jun 23 14:29:47 CDT 2006

FSCTL_GET_RETRIEVAL_POINTERS

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com

<WilleneP> wrote in message news:e8wvJ8qlGHA.1740@TK2MSFTNGP05.phx.gbl...
> Is it possile to get for a file seek position there corresponding offset
> into the drive volume?
>
>

WilleneP>
Mon Jun 26 07:57:43 CDT 2006

> FSCTL_GET_RETRIEVAL_POINTERS
>

Hello, can you help me, I started to yse this control, but sometimes
I receive zero in dwBytesReturned and DeviceIOControl does not
return zero? I don't understand what this means? It only happens
for small files?
Thanks.

peterwie
Mon Jun 26 12:05:55 CDT 2006

This is just a guess but ...

On an NTFS volume small files can be "attribute resident" meaning that their
contents are stored in the directory entry rather than in a block on disk.
Such files probably don't respond to this fs-control.

-p

<WilleneP> wrote in message news:u%23PqEBSmGHA.1912@TK2MSFTNGP02.phx.gbl...
>> FSCTL_GET_RETRIEVAL_POINTERS
>>
>
> Hello, can you help me, I started to yse this control, but sometimes
> I receive zero in dwBytesReturned and DeviceIOControl does not
> return zero? I don't understand what this means? It only happens
> for small files?
> Thanks.
>
>

Maxim
Mon Jun 26 12:28:27 CDT 2006

> On an NTFS volume small files can be "attribute resident" meaning that their
> contents are stored in the directory entry rather than in a block on disk.

In MFT record, not in the dirent.

Yes, these files are not responding to "get retrieval pointers".

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com

WilleneP>
Wed Jun 28 05:48:46 CDT 2006

So I assume what I need to do is locate the mft block in the volume,
then walk through the block, printing every file that doesn't have
clusters. Is this wright? How do I do this?

Maxim
Wed Jun 28 10:33:06 CDT 2006

No documented ways, and the undocumented ones will not tolerate co
operation with mounted NTFS (which can make updates to these structures) and
can only work offline.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com

<WilleneP> wrote in message news:u3fIYCqmGHA.2160@TK2MSFTNGP04.phx.gbl...
> So I assume what I need to do is locate the mft block in the volume,
> then walk through the block, printing every file that doesn't have
> clusters. Is this wright? How do I do this?
>
>

Jonathan
Wed Jun 28 22:56:21 CDT 2006

W> So I assume what I need to do is locate the mft block in the volume,
W> then walk through the block, printing every file that doesn't have
W> clusters. Is this wright?

How can we know? You haven't told us what you are actually trying to
do, so there's no way for us to tell you whether you are going about
achieving your goal in the right way.

Joep
Thu Jun 29 17:01:12 CDT 2006


"Jonathan de Boyne Pollard" <J.deBoynePollard-newsgroups@NTLWorld.COM> wrote
in message news:c1.01.31TSNR$5AJ@J.de.Boyne.Pollard.localhost...
>W> So I assume what I need to do is locate the mft block in the volume,
> W> then walk through the block, printing every file that doesn't have
> W> clusters. Is this wright?
>

If you open the drive by drive letter the offset of the volume is
irrelevant. If you open a physical device you detremine your offset by
parsing and interpreting the partition tables or the LDM.

Offset to the MFT start can be found in the boot sector. It is a cluster
value so yout offset is cluster no * sectors per cluster * 512.

The MFT is not per se 1 block. As it is treated as a file it may be
fragmented (rare, but can be. I have seen that and can at least force it to
fragment).

Parsing and interpreting the MFT is possible but not that easy. MS did not
release free and public NTFS documentation so you will have to reverse
engineer or consult open source documentation (Linux NTFS Documentation
Project).

What is your goal anyway? Why do you want to have a list of files that have
no clusters allocated, delete them? There may be files that have no clusters
allocated that are still valid files: If the data stream of a file fits the
FRS, the entire file is stored in the MFT.

For example the boot.ini often is small enough to be entirely in the MFT,
you still do not want to delete it.

--
Joep
http://www.diydatarecovery.nl