Parsing NTFS Filesystem

Nov 23, 2010 at 4:19 PM

I was looking at DiscUtils.NTFS and was wondering if it could be used to parse a filesystem of a logical volume (i.e. C:\) and return a listing of all files and attributes (size, fullpath, mft entry id, last written, created, modified, resident, etc...).

It seems that the StandardInformation class has most of this information, but it is sealed.  Any way to get at this?  Any sample snippet you could provide would be appreciated.

Thanks in advance.

Coordinator
Nov 23, 2010 at 10:20 PM

A lot of this information is available from the NtfsFileSystem class.

GetFileStandardInformation() returns most of it, and you can get the MFT index by calling GetFileId() (mask off the top 16 bits of the return value).

Cheers,

Ken

Nov 23, 2010 at 11:09 PM

I downloaded the samples and DiskClone had a lot of what I was looking for.  I was looking for a quicker way than GetFiles to enumerate a listing of files (and attributes) on a Volume. Looks like Dump() does a lot of what I need, I just need to create a duplicate that only returns what I am looking for.

MFTID, File Name, Full Path, (Both Filename and Std Info dates), Size, etc...