How to determine allocated blocks on an NTFS disk

Question

Is there a way of determining which clusters on an NTFS disk are allocated? I'm thinking along the lines of the display you see on a defrag program before you kick off the defrag itself.

I guess you could parse the MFT but it strikes me that this could take a long time on a system with potentially hundreds of thousands of files.

Thanks

Answer 1

The easiest is to get the drive bitmap with I/O controls. There is a nice open source defragmenter that can give you a good example on how to do it: JkDefrag (NOTE: the MyDefrag is not open source). Jeffey Wall's WebLog also contains a bunch of links that might interest you.

Another interesting article about the FSCTL_GET_VOLUME_BITMAP I/O control is provided by microsoft.