Retrieving File Sector Location Using a Minifilter

chex2020

Please is there a structure to retrieve the disk sector(s) occupied by a file in kernel mode?

Peter_Viscarola_(OSR)

Did you even try Googling for this.

FSCTL_GET_RETRIEVAL_POINTERS is what you want.

Peter

chex2020

Thank you very much. I did try to google it but maybe because I didn't know what I was looking for I couldn't find it. The structure below is the closest I came to finding a solution. I haven't tried to use it yet, so I'm glad I have to have something else to explore.

extern "C" BOOL ReadDiskSector(int drive, DWORD startinglogicalsector, int numberofsectors, BYTE *buffer)
{
HANDLE hDevice;
DWORD bytesread;

// Creating a handle to drive a: using CreateFile () function ..   
char _devicename[] = "\\\\.\\PhysicalDrive0";   
_devicename[17] += drive;   
hDevice = CreateFile(_devicename,  // drive to open   
                    GENERIC_READ,     // access type   
                    FILE_SHARE_READ | // share mode   
                    FILE_SHARE_WRITE,    
                    NULL,             // default security attributes   
                    OPEN_EXISTING,    // disposition   
                    0,                // file attributes   
                    NULL);            // do not copy file attributes   


if (hDevice == INVALID_HANDLE_VALUE)    
    return FALSE;   

DiskFileSeek(hDevice, (startinglogicalsector),FILE_BEGIN);   

if (!ReadFile (hDevice, buffer, 512*numberofsectors, &bytesread, NULL) )   
     return FALSE;   

CloseHandle(hDevice);    
return TRUE;   

}