Reset file contents $ mft

Question

for some commercial project that I am doing, I need to be able to read the actual data stored in the $ mft file.

I found gpl lib that could help, but since I can’t integrate its gpl into my code.

can someone point me to a project that I could use / or point me to the corresponding Windows API (which does not require 1000 lines of code for implementation)

By the way, why windows just don't let me read the mft file directly? (through the creation file and the reading method, if I want to destroy my disk, this is my business, not Ms.).

thanks.

Answer 1

You just need to open the volume descriptor using CreateFile () in \. \ X: where X is the drive letter (check the MSDN documentation on CreateFile (), this is mentioned in the Remarks section).

Read the first sector in the NTFS boot record structure (you can find it on the Internet, find Richard "Flatcap" Russon, change: I found it, http://www.flatcap.org/ntfs/ntfs/files/boot.html ). One of the fields in the boot sector structure gives the initial MFT location in the clusters (LCN VCN 0 of $ MFT), you must setFilePointer () so that this place is read in multiple sectors. The first 1024 bytes from this location are the $ MFT file entry, again you can analyze this structure to find a data attribute that is always non-resident, and the size of this file is the actual size of the MFT file at this time.

The basic structures for $ Boot, File Record, and basic attributes (standard information, file name, and data) along with the parsing code must contain less than 1000 lines of code.

Answer 2

This will not be a trivial offer. To do this, you probably have to fold your own code. You can get the details of the $ MFT by checking http://www.ntfs.com/ntfs-mft.htm

Another option is to spend some time looking at the source code on an open source NTFS-3g project. You can download the source code from http://www.tuxera.com/community/ntfs-3g-download/

Another good project is NTFSProgs http://en.wikipedia.org/wiki/Ntfsprogs

Good luck.