Extract $bitmap file from NTFS Image

Question

Does anyone know of any software that can extract the $bitmap file from NTFS images?

Or does anyone know of any site that documents NTFS enough so that I can code this myself?

(I want to read the $bitmap so I can identify what clusters are not in use, so they can be removed from the images)

Answer 1

There's one short paragraph in this early publication by a talented person:

http://www.alex-ionescu.com/NTFS.pdf

Answer 2

There is also "Forensic File systems " by Brian Carrier. It does explain NTFS in detail. ntfs.org also is helful

Since $Bitmap is a system file, you can't open it up and read it. Also beware that if the disk is in use, it can change.

Answer 3

I answered this one in a different place, but on a live Windows machine the best answer is probably to use FSCTL_GET_VOLUME_BITMAP. This will reflect any changes the FS knows about that aren't on the disk.