dcsimg
CodeGuru Home VC++ / MFC / C++ .NET / C# Visual Basic VB Forums Developer.com
Results 1 to 7 of 7

Thread: Reading HDD sectors

  1. #1
    Join Date
    Jan 2009
    Posts
    288

    Reading HDD sectors

    I am trying to read deleted files from HDD, and for starting I have tried to read sectors from HDD with following code:
    Code:
    	HANDLE hVolume = CreateFile(sVolume, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, 
    		OPEN_EXISTING, FILE_FLAG_SEQUENTIAL_SCAN, NULL);
    
    	if (INVALID_HANDLE_VALUE == hVolume)
    	{
    		m_sState.Format(_T("Invalid volume"));
    		return FALSE;
    	}
    
    	GENERIC_BOOT_SECTOR Boot;
    	Boot.wBytesPerSector = 512;
    	if (0xFFFFFFFF == SetFilePointer(hVolume, 0, 0, FILE_BEGIN) &&
    		NO_ERROR != GetLastError())
    	{
    		m_sState.Format(_T("Set file pointer error"));
    		return FALSE;
    	}
    
    	DWORD numr, len = Boot.wBytesPerSector;
    	if (! ReadFile(hVolume, &Boot, len, &numr, NULL) || numr != len)
    	{
    		m_sState.Format(_T("Read file error"));
    		return FALSE;
    	}
    when I tried to read FAT32 HDD, the result was promising:
    Code:
    		Boot.wBytesPerSector	2
    		Boot.btSectorsPerCluster	0 '\0'
    but when I read exFAT HDD, the result:
    Code:
    		Boot.wBytesPerSector	0
    		Boot.btSectorsPerCluster	0 '\0'
    GENERIC_BOOT_SECTOR has the following definition:

    Code:
    struct GENERIC_BOOT_SECTOR
    {
    	WORD wBytesPerSector;
    	BYTE btSectorsPerCluster;
    };
    can you lead me into achieving the task ? I didn't read well the exFAT HDD ?

  2. #2
    2kaud's Avatar
    2kaud is offline Super Moderator Power Poster
    Join Date
    Dec 2012
    Location
    England
    Posts
    6,697

    Re: Reading HDD sectors

    What is sVolume set to?

    For reading a physical drive/volume you use DeviceIoControl See https://docs.microsoft.com/en-us/win...eviceiocontrol and the link to the example which gives bytespersector, sectorspertrack & trackspercylinder
    All advice is offered in good faith only. All my code is tested (unless stated explicitly otherwise) with the latest version of Microsoft Visual Studio (using the supported features of the latest standard) and is offered as examples only - not as production quality. I cannot offer advice regarding any other c/c++ compiler/IDE or incompatibilities with VS. You are ultimately responsible for the effects of your programs and the integrity of the machines they run on. Anything I post, code snippets, advice, etc is licensed as Public Domain https://creativecommons.org/publicdomain/zero/1.0/ and can be used without reference or acknowledgement. Also note that I only provide advice and guidance via the forums - and not via private messages!

    C++17 Compiler: Microsoft VS2019 (16.1.3)

  3. #3
    Join Date
    Jan 2009
    Posts
    288

    Re: Reading HDD sectors

    Thank you 2kaud, I have found the information that I need it ... now I have to go forward to see how can I read the deleted files from HDD ...

    In my searches, I have found an interesting article which tell me the details that I have seek it: https://www.codeguru.com/cpp/cpp/cpp...oot-Sector.htm

  4. #4
    Join Date
    Jan 2009
    Posts
    288

    Re: Reading HDD sectors

    Yes, I can read some of the needed info with DeviceIoControl, but in this way I should modify almost all code, and there is no time for that.

    I reproduced even more the original code:
    Code:
    struct GENERIC_BOOT_SECTOR
    {
    	BYTE Jump[3];
    	BYTE OemName[8];
    	WORD BytesPerSector;
    	BYTE SectorsPerCluster;
    	BYTE DontCare[512 - 14];
    };
    
    class CVolume
    {
    public:
    	CVolume();
    	virtual ~CVolume();
    	void Open();
    
    	union
    	{
    		GENERIC_BOOT_SECTOR Boot;
    	};
    
    protected:
    	BOOL ReadSectors(void* buffer);
    };
    and
    Code:
    void CVolume::Open()
    {
    	Boot.BytesPerSector = 512;
    	ReadSectors(&Boot);
    }
    
    BOOL CVolume::ReadSectors(void* buffer)
    {
    	CString sVolume(_T("H:\\"));
    	if ('\\' == sVolume.GetAt(sVolume.GetLength() - 1))
    	{
    		CString sTemp(sVolume);
    		sVolume.Format(_T("\\\\.\\%s"), sTemp.Left(sTemp.GetLength() - 1));
    	}
    
    	HANDLE hVolume = CreateFile(sVolume, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
    		OPEN_EXISTING, FILE_FLAG_SEQUENTIAL_SCAN, NULL);
    
    	if (INVALID_HANDLE_VALUE == hVolume)
    	{
    		return FALSE;
    	}
    
    	if (0xFFFFFFFF == SetFilePointer(hVolume, 0, 0, FILE_BEGIN) &&
    		NO_ERROR != GetLastError())
    	{
    		CloseHandle(hVolume);
    		return FALSE;
    	}
    
    	Boot.BytesPerSector = 512;
    	DWORD numr, len = Boot.BytesPerSector;
    	if (! ReadFile(hVolume, buffer, len, &numr, NULL) || numr != len)    // here is read the hdd info
    	{
    		CloseHandle(hVolume);
    		return FALSE;
    	}
    
    	return TRUE;
    }
    I even attached the sample project for testing purpose (Just run Edit->ReadHDD menu item). The problem here is that GENERIC_BOOT_SECTOR struct is populated correctly on NTFS and FAT32, but not for exFAT ... and I don't get it why ?ReadHDD.zip

  5. #5
    2kaud's Avatar
    2kaud is offline Super Moderator Power Poster
    Join Date
    Dec 2012
    Location
    England
    Posts
    6,697

    Re: Reading HDD sectors

    Probably because the layout of an exFat boot sector isn't the same as your GENERIC_BOOT_SECTOR struct. The layout of an exFat volume is documented at http://www.ntfs.com/exfat-boot-sector.htm - which doesn't map to GENERIC_BOOT_SECTOR struct. You'll need to define a different struct for exFat, and have this as well in your union. Then use which is the appropriate depending upon what is read. For exFat, the oemName in GENERIC_BOOT_SECTOR will be EXFAT, so if it is you then use the exFat union structure and not the generic boot sector structure.
    All advice is offered in good faith only. All my code is tested (unless stated explicitly otherwise) with the latest version of Microsoft Visual Studio (using the supported features of the latest standard) and is offered as examples only - not as production quality. I cannot offer advice regarding any other c/c++ compiler/IDE or incompatibilities with VS. You are ultimately responsible for the effects of your programs and the integrity of the machines they run on. Anything I post, code snippets, advice, etc is licensed as Public Domain https://creativecommons.org/publicdomain/zero/1.0/ and can be used without reference or acknowledgement. Also note that I only provide advice and guidance via the forums - and not via private messages!

    C++17 Compiler: Microsoft VS2019 (16.1.3)

  6. #6
    Join Date
    Jan 2009
    Posts
    288

    Re: Reading HDD sectors

    I have solved this step, but now there is more things to solve: for instance, how can I know the number of Sectors in exFAT ? The goal is to read deleted files from an exFAT drive ... should I create another post for this question ?

  7. #7
    2kaud's Avatar
    2kaud is offline Super Moderator Power Poster
    Join Date
    Dec 2012
    Location
    England
    Posts
    6,697

    Re: Reading HDD sectors

    The info provided by http://www.ntfs.com/exfat-overview.htm and subsequent links contains all that is required in order to read an ex-Fat drive. It describes the boot sector, File Allocation Tables, directory structure etc etc. You need to read all of this and understand it. Word of caution. This is not easy!

    You might find these references of interest:
    https://www.sans.org/reading-room/wh...e-system-33274
    https://events.static.linuxfound.org...unegowda_s.pdf
    All advice is offered in good faith only. All my code is tested (unless stated explicitly otherwise) with the latest version of Microsoft Visual Studio (using the supported features of the latest standard) and is offered as examples only - not as production quality. I cannot offer advice regarding any other c/c++ compiler/IDE or incompatibilities with VS. You are ultimately responsible for the effects of your programs and the integrity of the machines they run on. Anything I post, code snippets, advice, etc is licensed as Public Domain https://creativecommons.org/publicdomain/zero/1.0/ and can be used without reference or acknowledgement. Also note that I only provide advice and guidance via the forums - and not via private messages!

    C++17 Compiler: Microsoft VS2019 (16.1.3)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  


Windows Mobile Development Center


Click Here to Expand Forum to Full Width




On-Demand Webinars (sponsored)