Jump to content
Sign in to follow this  
wraithdu

NTFS Questions

Recommended Posts

wraithdu

I am writing a UDF that utilizes the defragmentation API (specifically FSCTL_GET_RETRIEVAL_POINTERS and IOCTL_VOLUME_LOGICAL_TO_PHYSICAL) to map a file's location on disk. The goal is to use this to update my secure file deletion script. I have a few unanswered questions though regarding the filesystem that are fairly important. Any takers?

1) Are file extents (not including the final extent or files taking up only a single extent) guaranteed to completely fill a block of clusters, ie no unused bytes at the end of the last cluster in the block?

2) Is a disk cluster guaranteed to only contain data from one file? So a 2K file only takes up part of a 4K cluster... can the rest of that cluster contain data from another file? If so, same question regarding a single sector (usually 512 bytes, vs a 4K cluster)?

I think the answer is yes to both question... but that's a dangerous assumption when you're writing directly to the disk.

Share this post


Link to post
Share on other sites
BrewManNH

1 file per cluster, 1 file per sector. Not sure what a file extent is, but if you have a 4K cluster size and a 1K file, that file will inhabit one cluster, and approx. 3K of that cluster will be unknown data.


If I posted any code, assume that code was written using the latest release version unless stated otherwise. Also, if it doesn't work on XP I can't help with that because I don't have access to XP, and I'm not going to.
Give a programmer the correct code and he can do his work for a day. Teach a programmer to debug and he can do his work for a lifetime - by Chirag Gude
How to ask questions the smart way!

I hereby grant any person the right to use any code I post, that I am the original author of, on the autoitscript.com forums, unless I've specifically stated otherwise in the code or the thread post. If you do use my code all I ask, as a courtesy, is to make note of where you got it from.

Back up and restore Windows user files _Array.au3 - Modified array functions that include support for 2D arrays.  -  ColorChooser - An add-on for SciTE that pops up a color dialog so you can select and paste a color code into a script.  -  Customizable Splashscreen GUI w/Progress Bar - Create a custom "splash screen" GUI with a progress bar and custom label.  -  _FileGetProperty - Retrieve the properties of a file  -  SciTE Toolbar - A toolbar demo for use with the SciTE editor  -  GUIRegisterMsg demo - Demo script to show how to use the Windows messages to interact with controls and your GUI.  -   Latin Square password generator

Share this post


Link to post
Share on other sites
wraithdu

Thank you. And an extent is a contiguous block of clusters belonging to a file, ie an extent is one fragment of a fragmented file. While the clusters that make up an extent must be contiguous, the extents that make up a file can be located physically anywhere on the disk, hence file fragmentation and the need to defragment.

So that just leaves #1 above. I'm pretty sure the answer is yes. I've successfully tested reading the mapped extents in order, directly from the disk, and comparing the rebuilt file to the original. This is actually an interesting process when it comes to compressed and EFS encrypted files. The original file cannot be trivially recovered since the OS implements the compression or encryption transparently, and it doesn't know the rebuilt file is either compressed or encrypted. But the the rebuilt file contains the actual compressed or encrypted data as it is stored on disk.

Edited by wraithdu

Share this post


Link to post
Share on other sites
BrewManNH

As long as the file fragment you're dealing with isn't the last one, then it will be filled with the file's information and nothing else, because the last one is the only one that may or may not fill that last cluster.


If I posted any code, assume that code was written using the latest release version unless stated otherwise. Also, if it doesn't work on XP I can't help with that because I don't have access to XP, and I'm not going to.
Give a programmer the correct code and he can do his work for a day. Teach a programmer to debug and he can do his work for a lifetime - by Chirag Gude
How to ask questions the smart way!

I hereby grant any person the right to use any code I post, that I am the original author of, on the autoitscript.com forums, unless I've specifically stated otherwise in the code or the thread post. If you do use my code all I ask, as a courtesy, is to make note of where you got it from.

Back up and restore Windows user files _Array.au3 - Modified array functions that include support for 2D arrays.  -  ColorChooser - An add-on for SciTE that pops up a color dialog so you can select and paste a color code into a script.  -  Customizable Splashscreen GUI w/Progress Bar - Create a custom "splash screen" GUI with a progress bar and custom label.  -  _FileGetProperty - Retrieve the properties of a file  -  SciTE Toolbar - A toolbar demo for use with the SciTE editor  -  GUIRegisterMsg demo - Demo script to show how to use the Windows messages to interact with controls and your GUI.  -   Latin Square password generator

Share this post


Link to post
Share on other sites
wraithdu

Thanks for confirming what I originally suspected.

Share this post


Link to post
Share on other sites
KaFu
KaFu

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×