source: trunk/eraser6/Eraser.Util/NtfsApi.cs @ 1859

Revision 1859, 2.8 KB checked in by lowjoel, 4 years ago (diff)

For NTFS MFT Record lengths we need volume (data) read access so instead catch unauthorized access exceptions (i.e. when running under a split user token in 7) and return using the heuristic of one of volume cluster size and 1024 bytes, whichever is smaller

  • Property svn:eol-style set to native
  • Property svn:keywords set to Id
Line 
1/*
2 * $Id$
3 * Copyright 2008-2010 The Eraser Project
4 * Original Author: Joel Low <lowjoel@users.sourceforge.net>
5 * Modified By:
6 *
7 * This file is part of Eraser.
8 *
9 * Eraser is free software: you can redistribute it and/or modify it under the
10 * terms of the GNU General Public License as published by the Free Software
11 * Foundation, either version 3 of the License, or (at your option) any later
12 * version.
13 *
14 * Eraser is distributed in the hope that it will be useful, but WITHOUT ANY
15 * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
16 * A PARTICULAR PURPOSE. See the GNU General Public License for more details.
17 *
18 * A copy of the GNU General Public License can be found at
19 * <http://www.gnu.org/licenses/>.
20 */
21
22using System;
23using System.Collections.Generic;
24using System.Text;
25using Microsoft.Win32.SafeHandles;
26using System.Runtime.InteropServices;
27using System.IO;
28
29namespace Eraser.Util
30{
31    public static class NtfsApi
32    {
33        /// <summary>
34        /// Gets the actual size of the MFT.
35        /// </summary>
36        /// <param name="volume">The volume to query.</param>
37        /// <returns>The size of the MFT.</returns>
38        public static long GetMftValidSize(VolumeInfo volume)
39        {
40            return GetNtfsVolumeData(volume).MftValidDataLength;
41        }
42
43        /// <summary>
44        /// Gets the size of one MFT record segment.
45        /// </summary>
46        /// <param name="volume">The volume to query.</param>
47        /// <returns>The size of one MFT record segment.</returns>
48        public static long GetMftRecordSegmentSize(VolumeInfo volume)
49        {
50            try
51            {
52                return GetNtfsVolumeData(volume).BytesPerFileRecordSegment;
53            }
54            catch (UnauthorizedAccessException)
55            {
56                return Math.Min(volume.ClusterSize, 1024);
57            }
58        }
59
60        /// <summary>
61        /// Sends the FSCTL_GET_NTFS_VOLUME_DATA control code, returning the resuling
62        /// NTFS_VOLUME_DATA_BUFFER.
63        /// </summary>
64        /// <param name="volume">The volume to query.</param>
65        /// <returns>The NTFS_VOLUME_DATA_BUFFER structure representing the data
66        /// file systme structures for the volume.</returns>
67        /// <exception cref="UnauthorizedAccessException">Thrown when the current user
68        /// does not have the permissions required to obtain the volume information.</exception>
69        internal static NativeMethods.NTFS_VOLUME_DATA_BUFFER GetNtfsVolumeData(VolumeInfo volume)
70        {
71            using (SafeFileHandle volumeHandle = volume.OpenHandle(
72                FileAccess.Read, FileShare.ReadWrite, FileOptions.None))
73            {
74                uint resultSize = 0;
75                NativeMethods.NTFS_VOLUME_DATA_BUFFER volumeData =
76                    new NativeMethods.NTFS_VOLUME_DATA_BUFFER();
77                if (NativeMethods.DeviceIoControl(volumeHandle,
78                    NativeMethods.FSCTL_GET_NTFS_VOLUME_DATA, IntPtr.Zero, 0, out volumeData,
79                    (uint)Marshal.SizeOf(volumeData), out resultSize, IntPtr.Zero))
80                {
81                    return volumeData;
82                }
83
84                throw Win32ErrorCode.GetExceptionForWin32Error(Marshal.GetLastWin32Error());
85            }
86        }
87    }
88}
Note: See TracBrowser for help on using the repository browser.