Getting Information From Master File Table on Windows

Question

Hi,

I need to get some information that is contained in the MFT on a Windows machine, and I'm hoping that there is some super-secret API for getting this information. I need to be able to get to this information programmatically, and because of legal concerns I might not be able to use the tools provided by the company formally known as sysinternals.

My other option (which I really don't want to have to do) is to get the start sector of the MFT with DeviceIoControl, and manually parse through the information.

Anyway, in particular, what I really need to get out of the Master File Table is the logical sectors used to hold the data that is associated with a file.

Thanks,

Terry

Answer 1

There is a documented API for getting info on file positions on disk since Windows 2000. Look for DeviceIoControl function with FSCTL_GET_RETRIEVAL_POINTERS control code on MSDN:

http://msdn.microsoft.com/en-us/library/aa364572(VS.85).aspx

The API has been provided for writing custom disk defragmenters and consists of several other control codes.