获取文件的簇占用信息

// GetFileClusters.cpp : 定义控制台应用程序的入口点。
//

#include "stdafx.h"
#include <windows.h>
#include <assert.h>

BOOL GetFileClusters(LPCTSTR lpszFileName)
{
    DWORD dwExtentIndex = 0;

    assert(lpszFileName != NULL);

    if (lpszFileName == NULL)
        return FALSE;

    HANDLE hFile = CreateFile(lpszFileName, FILE_READ_DATA || FILE_WRITE_DATA || FILE_APPEND_DATA || FILE_EXECUTE, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL,\
        NULL);

    if (hFile == INVALID_HANDLE_VALUE)
        return FALSE;

    STARTING_VCN_INPUT_BUFFER StartVcnInbuff = {0};
    BOOL bIsOK = TRUE;
    DWORD dwInfoSize = sizeof (RETRIEVAL_POINTERS_BUFFER);
    DWORD dwReciveLen = 0;
    LARGE_INTEGER ExtentLength;
    LARGE_INTEGER TotalClusters;

    ExtentLength.QuadPart = 0;
    TotalClusters.QuadPart = 0;

    while (TRUE)
    {
        PRETRIEVAL_POINTERS_BUFFER pRetrievalBuff = (PRETRIEVAL_POINTERS_BUFFER)GlobalAlloc(GPTR, dwInfoSize);
        if (pRetrievalBuff == NULL)
        {
            bIsOK = FALSE;
            break;
        }

        bIsOK = DeviceIoControl(hFile, FSCTL_GET_RETRIEVAL_POINTERS, &StartVcnInbuff, sizeof(STARTING_VCN_INPUT_BUFFER),\
        pRetrievalBuff, dwInfoSize, &dwReciveLen, NULL);

        if (bIsOK)
        {
            for (UINT32 i = 0; i < pRetrievalBuff->ExtentCount; i++)
            {
                ExtentLength.QuadPart = pRetrievalBuff->Extents[i].NextVcn.QuadPart - pRetrievalBuff->StartingVcn.QuadPart;

                printf("Extent[%d] LCN = %I64ld \t VCN = %I64ld \t Clusters = %I64ld/End LCN = %I64ld\n", dwExtentIndex, pRetrievalBuff->Extents[i].Lcn,\
                    pRetrievalBuff->StartingVcn.QuadPart, ExtentLength, pRetrievalBuff->Extents[i].Lcn.QuadPart + ExtentLength.QuadPart - 1);

                TotalClusters.QuadPart += ExtentLength.QuadPart;
                StartVcnInbuff.StartingVcn = pRetrievalBuff->Extents[i].NextVcn;
                dwExtentIndex ++;
            }
            printf("----------------------------------------\n");
            printf("Total Clusters:%I64d\n", TotalClusters);
            printf("Total Extends:%u\n", dwExtentIndex);

            break;
        }
        else
        {
            DWORD dwErrorCode = GetLastError();

            if (dwErrorCode == ERROR_INSUFFICIENT_BUFFER)
            {
                //    输出缓冲区太小了
                GlobalFree(pRetrievalBuff);
                pRetrievalBuff = NULL;

                dwInfoSize *= 2;
                continue;
            }
            else if (dwErrorCode == ERROR_MORE_DATA)
            {
                for (UINT32 i = 0; i < pRetrievalBuff->ExtentCount; i++)
                {
                    ExtentLength.QuadPart = pRetrievalBuff->Extents[i].NextVcn.QuadPart - pRetrievalBuff->StartingVcn.QuadPart;

                    printf("Extent[%d] LCN = %I64ld \t VCN = %I64ld \t Clusters = %I64ld/End LCN = %I64ld\n", dwExtentIndex, pRetrievalBuff->Extents[i].Lcn,\
                        pRetrievalBuff->StartingVcn.QuadPart, ExtentLength, pRetrievalBuff->Extents[i].Lcn.QuadPart + ExtentLength.QuadPart - 1);

                    TotalClusters.QuadPart += ExtentLength.QuadPart;
                    StartVcnInbuff.StartingVcn = pRetrievalBuff->Extents[i].NextVcn;

                    dwExtentIndex ++;
                }
                continue;
            }
            else
            {
                GlobalFree(pRetrievalBuff);
                pRetrievalBuff = NULL;
                printf("Error:%d\n", dwErrorCode);
            }
        }

    }

    CloseHandle(hFile);

    return bIsOK;
}

int _tmain(int argc, _TCHAR* argv[])
{
    GetFileClusters(TEXT("F:\\SYSTEMBAK\\Y450.GHO"));

    return 0;
}

输出：

 

转载于:https://www.cnblogs.com/robinh00d/archive/2010/01/18/1651005.html