Reading Image of active harddisk

NTFSD
1

Hi NTFSD Gurus,

How to read full image of active partition of NTFS file system using file system filter driver?
Is there is any API for copy-on-write method in kernel mode?Pls any one knows help me, thanks in advance.

2

The best you’ll probably be able to do for reading an active NTFS partition is to create a volume shadow copy of that partition and then read that data from that partition. It does support copy-on-write. I’ve only used in in user-mode, so I can’t speak to using it in a FSFD:

http://technet2.microsoft.com/WindowsServer/en/library/2b0d2457-b7d8-42c3-b6c9-59c145b7765f1033.mspx?mfr=true

Hope that helps,
Bill