NTFS格式 读取MFT信息

#include "ntfs.h" #include <iostream> #include <fstream> #include <map> #include <vector> using namespace std; //管理员权限运行 typedef struct { ULONGLONG index; ULONGLONG parent; WCHAR name[1024]; int type; //0 file 1 dir } FILE_INFO, *PFILE_INFO; //枚举盘符 void OpenNtfsVolume() { WCHAR tDrivers[26*4+1] = {}; GetLogicalDriveStrings(26*4+1,tDrivers); WCHAR fileSysBuf[8]; DWORD dwDri; //0~25 WCHAR szRootName[40]; WCHAR szVolumeName[32]; int iFilterRoot=0; for(WCHAR *p=tDrivers;*p!='\0';p+=4) { if(*p>=L'a') *p-=32;// dwDri=*p-L'A'; if(DRIVE_FIXED==GetDriveTypeW(p)) { DWORD dwMaxComLen,dwFileSysFlag; GetVolumeInformationW(p,szVolumeName,32,NULL,&dwMaxComLen,&dwFileSysFlag,fileSysBuf,8); if(fileSysBuf[0]==L'N' && fileSysBuf[1]==L'T' && fileSysBuf[2]==L'F' && fileSysBuf[3]==L'S') { swprintf(szRootName,L"%s (%c:)",szVolumeName,*p); WCHAR szVolumePath[10]; swprintf(szVolumePath,L"\\\\.\\%c:",*p); wcout<<szVolumePath<<endl; } } } } int main() { //wcout.imbue(locale(locale(),"",LC_CTYPE)); char szACP[16]; sprintf(szACP, ".%d", GetACP()); //setlocale(LC_CTYPE, szACP); wcout.imbue(locale(locale(),szACP,LC_CTYPE)); OpenNtfsVolume(); WCHAR driveletter[] = L"\\\\.\\D:"; HANDLE hVol = CreateFile(driveletter, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE,NULL,OPEN_EXISTING,0,NULL); NTFS_VOLUME_DATA_BUFFER ntfsVolData; DWORD dwWritten = 0; BOOL bDioControl = DeviceIoControl(hVol, FSCTL_GET_NTFS_VOLUME_DATA, NULL, 0, &ntfsVolData, sizeof(ntfsVolData), &dwWritten, NULL); if (!bDioControl) {wcout<<L"error"<<endl; return 1;} LARGE_INTEGER num; num.QuadPart = 1024; LONGLONG total_file_count = (ntfsVolData.MftValidDataLength.QuadPart/num.QuadPart); wcout<<L"total_file_count:"<<total_file_count<<endl; PNTFS_FILE_RECORD_OUTPUT_BUFFER ntfsFileRecordOutput = (PNTFS_FILE_RECORD_OUTPUT_BUFFER)malloc(sizeof(NTFS_FILE_RECORD_OUTPUT_BUFFER)+ntfsVolData.BytesPerFileRecordSegment-1); for( LONGLONG i = 0; i < total_file_count && i < 10;i++) { NTFS_FILE_RECORD_INPUT_BUFFER mftRecordInput; mftRecordInput.FileReferenceNumber.QuadPart = i; memset(ntfsFileRecordOutpu