Query about FSCTL_GET_VOLUME_BITMAP

NTFSD
1

Hello,

I am using FSCTL_GET_VOLUME_BITMAP to find out only the occupied clusters on a NTFS volume and copy them and restore these clusters.

However if my 2GB volume has 77 MB occupied (in disk manager),

When I use FSCTL_GET_VOLUME_BITMAP I see only 72 MB getting copied.

After the backed up clusters are copied back to a destination volume the files are not seen.
When I use chkdsk /f on this volume, chkdsk fixes some errors and the files are seen.

Is there anything missing?

My program is as follows…

DWORD dwRead;
ret = DeviceIoControl(hVolume, FSCTL_GET_VOLUME_BITMAP, &slcn, sizeof(slcn), volBitmap, SIZEVOL, &dwRetBytes, NULL);
cout << endl << "Total number of clusters on volume " << volBitmap->BitmapSize.QuadPart << endl;
__int64 filledClusters=0;

if(!DeviceIoControl(hVolume, FSCTL_LOCK_VOLUME, NULL, 0, NULL, 0, &dwRead, NULL))
{
cout << "Failed to lock the volume returning " << endl;
return 0;
}

for(__int64 i=0; i < (volBitmap->BitmapSize.QuadPart)/8; ++i)
{
for(int j = 7; j >= 0; --j)
{
if((volBitmap->Buffer[i] & (1< {
usedClusters.push_back(i8+(7-j));
cout << endl << “used cluster = :” << (i8+(7-j));
filledClusters++;
}
}
}

2

Don’t know if this could be a reason, you’re not checking the return
code of FSCTL_GET_VOLUME_BITMAP. It can return ERROR_MORE_DATA if
the provided buffer is too small to return the whole bitmap. In
which case you need to add a loop to get the remaining parts of the bitmap.

Mark.

At 11:21 29/03/2011, mandar.nanivadekar@hp.com wrote:

Hello,

I am using FSCTL_GET_VOLUME_BITMAP to find out only the occupied
clusters on a NTFS volume and copy them and restore these clusters.

However if my 2GB volume has 77 MB occupied (in disk manager),

When I use FSCTL_GET_VOLUME_BITMAP I see only 72 MB getting copied.

After the backed up clusters are copied back to a destination volume
the files are not seen.
When I use chkdsk /f on this volume, chkdsk fixes some errors and
the files are seen.

Is there anything missing?

My program is as follows…

DWORD dwRead;
ret = DeviceIoControl(hVolume,
FSCTL_GET_VOLUME_BITMAP, &slcn, sizeof(slcn), volBitmap, SIZEVOL,
&dwRetBytes, NULL);
cout << endl << "Total number of clusters on volume " <<
volBitmap->BitmapSize.QuadPart << endl;
__int64 filledClusters=0;

if(!DeviceIoControl(hVolume, FSCTL_LOCK_VOLUME, NULL, 0,
NULL, 0, &dwRead, NULL))
{
cout << "Failed to lock the volume returning " << endl;
return 0;
}

for(__int64 i=0; i < (volBitmap->BitmapSize.QuadPart)/8; ++i)
{
for(int j = 7; j >= 0; --j)
{
if((volBitmap->Buffer[i] & (1<> {
> usedClusters.push_back(i8+(7-j));
> cout << endl << “used cluster = :” << (i8+(7-j));
> filledClusters++;
> }
> }
> }
>
>
>—
>NTFSD is sponsored by OSR
>
>For our schedule of debugging and file system seminars visit:
>http://www.osr.com/seminars
>
>To unsubscribe, visit the List Server section of OSR Online at
>http://www.osronline.com/page.cfm?name=ListServer

3

Hello,

My buffer is BIG enough to fetch the entire volume bitmap. it is abt 50 MB. Which is more than enough for 2GB volume.
I also verified that my total cluster count and free cluster count matches with output of FSCTL_GET_NTFS_VOLUME_DATA.

I am not sure what is going wrong here.
Any other clues?

4

Is the volume being written while you’re doing your query and copy?

Thanks,
Alex.

5

I’m not sure which “disk manager” you mean, but if it’s adding up the file
sizes, it could be wrong.

A file that is listed as 100 bytes is actually all resident in the file
header, so no disk space is allocated. If it’s adding all that up, it could
come up with more disk space than is actually being used.

You might try FSCTL_GET_NTFS_VOLUME_DATA to see if your results match up any
better.

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
mandar.nanivadekar@hp.com
Sent: Tuesday, March 29, 2011 1:34 PM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] Query about FSCTL_GET_VOLUME_BITMAP

Hello,

My buffer is BIG enough to fetch the entire volume bitmap. it is abt 50 MB.
Which is more than enough for 2GB volume.
I also verified that my total cluster count and free cluster count matches
with output of FSCTL_GET_NTFS_VOLUME_DATA.

I am not sure what is going wrong here.
Any other clues?

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

6

Hello,

Alex, I always lock the volume using FSCTL_LOCK_VOLUME before backup and restore of clusters.

Ken,

  1. The used and free clusters returned by FSCTL_GET_NTFS_VOLUME_DATA are same as used/free clusters returned by FSCTL_GET_VOLUME_BITMAP

  2. How I compute volume space, In explorer if you select a volume and select “properties.” It shows occupied etg. 40 MB occupied,. however when I copy used cluster data from a volume, the size of destination file is less than the volume size reported by windows.

Thanks.
mandar