Can I read 320 bytes from a file without reading the entire file?

NTFSD
1

Hi,

In my postCreate event I have an algorithm that takes 320 bytes in a file from different places.

Can I read these 320 bytes from a file without reading the entire file?

Thanks in advance
Mattias Bergkvist

2

Why wouldn’t you be able?
Any way you do it, though, you’ll have to at least read 512 (or whatever sector size is); if you
use the cache then 4K chunks. (not directly but the cache will read 4K chunks or more)

xxxxx@netcleantech.com wrote:

Hi,

In my postCreate event I have an algorithm that takes 320 bytes in a file from different places.

Can I read these 320 bytes from a file without reading the entire file?

Thanks in advance
Mattias Bergkvist

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

–
Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.

3

The question is if I can read one byte in 320 different places, can I do that without reading the entire file?

Dejan Maksimovic

Any way you do it, though, you’ll have to at least read 512 (or whatever
sector size is)

So you mean that I can not read only one byte each time. So every read I do I must read at least 512 bytes.
Have I understood you correctly?

I use FltReadFile to read the file, are there some other ways to do it?

Thanks
Mattias Bergkvist

4

> The question is if I can read one byte in 320 different places, can I do that without reading the entire file?

Then no, if the bytes are at random positions, you need to read at least the surrounding 512 bytes. No way
to go around it.
Even though YOU can request 1 byte reads, the file system will still read 512 byte aligned chunks at a
minimum because the hard drives cannot read at a finer granularity. (some drives have larger sector sizes even)

So you mean that I can not read only one byte each time. So every read I do I must read at least 512 bytes.
Have I understood you correctly?

No, YOU CAN read one byte, but the reading API will still read in larger chunks and return only the byte
you need.
So, FltReadFile(File, Offset=2222, Length=1, CACHED read) will work.

–
Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.

5

You cannot read one byte from a disk, you have to instead read one sector
and then fetch the byte of interest from that sector. Everything above the
disk is constrained by that block io granularity.

On Feb 6, 2008 5:43 AM, wrote:

> The question is if I can read one byte in 320 different places, can I do
> that without reading the entire file?
>
> Dejan Maksimovic
> >Any way you do it, though, you’ll have to at least read 512 (or whatever
> >sector size is)
>
> So you mean that I can not read only one byte each time. So every read I
> do I must read at least 512 bytes.
> Have I understood you correctly?
>
> I use FltReadFile to read the file, are there some other ways to do it?
>
>
> Thanks
> Mattias Bergkvist
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@hollistech.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

–
Mark Roddy

6

answer to your question is yes and no.

yes because you can read 320 bytes from a file without reading the entire
file and fs will had you over the 320 bytes.
no becuase when you ask for 320 bytes from the file system, then the file
system internally reads in the multiples of clusters which are in the
multiple of sectors. so even if you ask for 320 bytes the underlying FS
reads more then that. so if your file size is 512 bytes then the whole file
will be read.

wrote in message news:xxxxx@ntfsd…
> Hi,
>
> In my postCreate event I have an algorithm that takes 320 bytes in a file
> from different places.
>
> Can I read these 320 bytes from a file without reading the entire file?
>
> Thanks in advance
> Mattias Bergkvist
>

7

> system internally reads in the multiples of clusters which are in the

multiple of sectors.

In multiple of sectors. Cluster is only an allocation unit, not an IO unit.

–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com