//FsctlSetEncryption //FsctlSetObjectId //FsctlSetObjectIdExtended //FsctlSetReparsePoint /// <summary><see cref="http://msdn.microsoft.com/en-us/library/windows/desktop/aa364596(v=vs.85).aspx"/></summary> public void FileSystemSetSparseFile(bool setSparse) { FILE_SET_SPARSE_BUFFER input = new FILE_SET_SPARSE_BUFFER(); input.SetSparse = setSparse; DeviceIoControlHelper.InvokeIoControl(Handle, IOControlCode.FsctlSetSparse, input); }
/// <summary><see cref="http://msdn.microsoft.com/en-us/library/windows/desktop/aa364597(v=vs.85).aspx"/></summary> public void FileSystemSetZeroData(long fileOffset, long length) { FILE_ZERO_DATA_INFORMATION input = new FILE_ZERO_DATA_INFORMATION(); input.FileOffset = fileOffset; input.BeyondFinalZero = fileOffset + length; DeviceIoControlHelper.InvokeIoControl(Handle, IOControlCode.FsctlSetZeroData, input); }
//FsctlHsmData //FsctlHsmMsg //FsctlInvalidateVolumes //FsctlIsPathnameValid //FsctlIsVolumeDirty //FsctlIsVolumeMounted //FsctlLockVolume //FsctlMarkAsSystemHive //FsctlMarkHandle //FsctlMarkVolumeDirty /// <summary><see cref="http://msdn.microsoft.com/en-us/library/aa364577(v=vs.85).aspx"/></summary> public void FileSystemMoveFile(IntPtr fileHandle, ulong startingVcn, ulong startingLcn, uint clusterCount) { MOVE_FILE_DATA input = new MOVE_FILE_DATA(); input.FileHandle = fileHandle; input.StartingVcn = startingVcn; input.StartingLcn = startingLcn; input.ClusterCount = clusterCount; DeviceIoControlHelper.InvokeIoControl(Handle, IOControlCode.FsctlMoveFile, input); }
/// <summary><see cref="http://msdn.microsoft.com/en-us/library/windows/desktop/aa364563(v=vs.85).aspx"/></summary> public IUSN_RECORD[] FileSystemEnumUsnData() { ulong nextUsn = 0; const int chunkSize = 1 * 1024 * 1024; // 1 MB chunks List <IUSN_RECORD> res = new List <IUSN_RECORD>(); using (UnmanagedMemory mem = new UnmanagedMemory(chunkSize)) { do { MFT_ENUM_DATA_V0 input = new MFT_ENUM_DATA_V0(); input.StartFileReferenceNumber = nextUsn; input.LowUsn = long.MinValue; input.HighUsn = long.MaxValue; int errorCode; byte[] data = DeviceIoControlHelper.InvokeIoControl(Handle, IOControlCode.FsctlEnumUsnData, chunkSize, input, out errorCode); Marshal.Copy(data, 0, mem, data.Length); if (errorCode != 0) { // Exit when theres no more to do break; } nextUsn = BitConverter.ToUInt64(data, 0); int dataOffset = 8; while (dataOffset < data.Length) { int length; IUSN_RECORD rec = ParseUsnRecord(mem, dataOffset, out length); if (length <= 0) { break; } res.Add(rec); // Move to next record dataOffset += length; } // Fetch next chunk } while (true); } return(res.ToArray()); }
/// <summary><see cref="http://msdn.microsoft.com/en-us/library/windows/desktop/aa364573(v=vs.85).aspx"/></summary> public VOLUME_BITMAP_BUFFER FileSystemGetVolumeBitmap(ulong startingLcn = 0) { STARTING_LCN_INPUT_BUFFER startingLcnStruct = new STARTING_LCN_INPUT_BUFFER(); startingLcnStruct.StartingLcn = startingLcn; // Fetch 128 bytes (this includes the size parameter of the VOLUME_BITMAP_BUFFER structure. int lastError; byte[] data = DeviceIoControlHelper.InvokeIoControl(Handle, IOControlCode.FsctlGetVolumeBitmap, 128, startingLcnStruct, out lastError); // Is there more data? (Most often there is). if (lastError == 234) { // Parse length attribute (2'nd 64-bit attribute) uint newLength = (uint)BitConverter.ToUInt64(data, 8); // Length: Clusters / 8 + 2x 64 bit numbers newLength = (uint)Math.Ceiling(newLength / 8d) + 2 * 8; data = DeviceIoControlHelper.InvokeIoControl(Handle, IOControlCode.FsctlGetVolumeBitmap, newLength, startingLcnStruct, out lastError); } // Ensure the last call to InvokeIoControl succeeded. if (lastError != 0) { throw new Win32Exception(lastError, "Couldn't invoke FileSystemGetVolumeBitmap. LastError: " + Utils.GetWin32ErrorMessage(lastError)); } // Build the VOLUME_BITMAP_BUFFER structure. VOLUME_BITMAP_BUFFER res = new VOLUME_BITMAP_BUFFER(); res.StartingLcn = BitConverter.ToUInt64(data, 0); res.BitmapSize = BitConverter.ToUInt64(data, sizeof(UInt64)); res.Buffer = new BitArray((int)res.BitmapSize); for (int i = 0; i < res.Buffer.Length; i++) { int dataByteIndex = sizeof(UInt64) * 2 + i / 8; byte dataByte = data[dataByteIndex]; int byteIdx = i % 8; res.Buffer[i] = ((dataByte >> byteIdx) & 1) == 1; } return(res); }
//DiskSetPartitionInfo //DiskSetPartitionInfoEx /// <summary><see cref="http://msdn.microsoft.com/en-us/library/windows/desktop/aa365173(v=vs.85).aspx"/></summary> public DRIVE_LAYOUT_INFORMATION DiskGetDriveLayout() { DRIVE_LAYOUT_INFORMATION_INTERNAL data = DeviceIoControlHelper.InvokeIoControl <DRIVE_LAYOUT_INFORMATION_INTERNAL>(Handle, IOControlCode.DiskGetDriveLayout); DRIVE_LAYOUT_INFORMATION res = new DRIVE_LAYOUT_INFORMATION(); res.PartitionCount = data.PartitionCount; res.Signature = data.Signature; res.PartitionEntry = new PARTITION_INFORMATION[res.PartitionCount]; for (int i = 0; i < res.PartitionCount; i++) { res.PartitionEntry[i] = data.PartitionEntry[i]; } return(res); }
/// <summary><see cref="http://msdn.microsoft.com/en-us/library/windows/desktop/aa365174(v=vs.85).aspx"/></summary> public DRIVE_LAYOUT_INFORMATION_EX DiskGetDriveLayoutEx() { DRIVE_LAYOUT_INFORMATION_EX_INTERNAL data = DeviceIoControlHelper.InvokeIoControl <DRIVE_LAYOUT_INFORMATION_EX_INTERNAL>(Handle, IOControlCode.DiskGetDriveLayoutEx); DRIVE_LAYOUT_INFORMATION_EX res = new DRIVE_LAYOUT_INFORMATION_EX(); res.PartitionStyle = data.PartitionStyle; res.PartitionCount = data.PartitionCount; res.DriveLayoutInformaiton = data.DriveLayoutInformaiton; res.PartitionEntry = new PARTITION_INFORMATION_EX[res.PartitionCount]; for (int i = 0; i < res.PartitionCount; i++) { res.PartitionEntry[i] = data.PartitionEntry[i]; } return(res); }
/// <summary><see cref="https://msdn.microsoft.com/en-us/library/windows/desktop/aa364586(v=vs.85).aspx"/></summary> public IUSN_RECORD[] FileSystemReadUsnJournal(long volumeJournalId, UsnJournalReasonMask reasonMask, USN firstUsn, int bytesToWaitFor = 0, int timeout = 0) { READ_USN_JOURNAL_DATA_V0 input = new READ_USN_JOURNAL_DATA_V0(); input.StartUsn = firstUsn; input.UsnJournalId = volumeJournalId; input.ReasonMask = reasonMask; input.BytesToWaitFor = bytesToWaitFor; input.Timeout = timeout; int errorCode; byte[] data = DeviceIoControlHelper.InvokeIoControl(Handle, IOControlCode.FsctlReadUsnJournal, 1024 * 1024, input, out errorCode); List <IUSN_RECORD> res = new List <IUSN_RECORD>(); using (UnmanagedMemory mem = new UnmanagedMemory(data)) { int dataOffset = 8; while (dataOffset < data.Length) { int length; IUSN_RECORD rec = ParseUsnRecord(mem, dataOffset, out length); if (length <= 0) { break; } res.Add(rec); // Move to next record dataOffset += length; } } return(res.ToArray()); }
//FsctlFindFilesBySid /// <summary><see cref="http://msdn.microsoft.com/en-us/library/windows/desktop/aa364567(v=vs.85).aspx"/></summary> public COMPRESSION_FORMAT FileSystemGetCompression() { return((COMPRESSION_FORMAT)DeviceIoControlHelper.InvokeIoControl <ushort>(Handle, IOControlCode.FsctlGetCompression)); }
/// <summary> /// Used to f.ex. close CD Rom trays /// <see cref="http://msdn.microsoft.com/en-us/library/windows/desktop/aa363414(v=vs.85).aspx" /> /// </summary> public bool StorageLoadMedia() { return(DeviceIoControlHelper.InvokeIoControl(Handle, IOControlCode.StorageLoadMedia)); }
//FsctlQueryFatBpb //FsctlQueryRetrievalPointers //FsctlQueryOnDiskVolumeInfo //FsctlReadPropertyData //FsctlReadRawEncrypted //FsctlRecallFile //FsctlRequestBatchOplock //FsctlRequestFilterOplock //FsctlRequestOplockLevel1 //FsctlRequestOplockLevel2 //FsctlSecurityIdCheck /// <summary><see cref="http://msdn.microsoft.com/en-us/library/windows/desktop/aa364592(v=vs.85).aspx"/></summary> public void FileSystemSetCompression(COMPRESSION_FORMAT level) { DeviceIoControlHelper.InvokeIoControl(Handle, IOControlCode.FsctlSetCompression, (ushort)level); }
//DiskSetDriveLayout //DiskSetDriveLayoutEx //DiskVerify //DiskFormatTracks //DiskReassignBlocks //DiskPerformance //DiskIsWritable //DiskLogging //DiskFormatTracksEx //DiskHistogramStructure //DiskHistogramData //DiskHistogramReset //DiskRequestStructure //DiskRequestData //DiskControllerNumber /// <summary><see cref="http://msdn.microsoft.com/en-us/library/windows/hardware/ff566202(v=vs.85).aspx"/></summary> public GETVERSIONINPARAMS DiskGetSmartVersion() { return(DeviceIoControlHelper.InvokeIoControl <GETVERSIONINPARAMS>(Handle, IOControlCode.DiskSmartGetVersion)); }
//DiskSmartSendDriveCommand //DiskSmartRcvDriveData //DiskUpdateDriveSize //DiskGrowPartition /// <summary><see cref="http://msdn.microsoft.com/en-us/library/windows/desktop/aa365165(v=vs.85).aspx"/></summary> public DISK_CACHE_INFORMATION DiskGetCacheInformation() { return(DeviceIoControlHelper.InvokeIoControl <DISK_CACHE_INFORMATION>(Handle, IOControlCode.DiskGetCacheInformation)); }
/// <summary><see cref="http://msdn.microsoft.com/en-us/library/windows/desktop/dd405526(v=vs.85).aspx"/></summary> /// <remarks> /// Does not correcly handle all cases of this method!. Especially regarding compressed/encrypted and/or sparse files in NTFS. /// Consider yourself warned. /// </remarks> public FileExtentInfo[] FileSystemGetRetrievalPointers() { STARTING_VCN_INPUT_BUFFER input = new STARTING_VCN_INPUT_BUFFER(); input.StartingVcn = 0; List <FileExtentInfo> extents = new List <FileExtentInfo>(); uint chunkSize = 1024; uint singleExtentSize = MarshalHelper.SizeOf <RETRIEVAL_POINTERS_EXTENT>(); int lastError; do { byte[] data = DeviceIoControlHelper.InvokeIoControl(Handle, IOControlCode.FsctlGetRetrievalPointers, chunkSize, input, out lastError); RETRIEVAL_POINTERS_BUFFER output = new RETRIEVAL_POINTERS_BUFFER(); output.ExtentCount = BitConverter.ToUInt32(data, 0); output.StartingVcn = BitConverter.ToUInt64(data, sizeof(ulong)); output.Extents = new RETRIEVAL_POINTERS_EXTENT[output.ExtentCount]; // Parse extents int extentsSize = (int)(output.ExtentCount * singleExtentSize); using (var dataPtr = new UnmanagedMemory(extentsSize)) { Marshal.Copy(data, sizeof(ulong) + sizeof(ulong), dataPtr, extentsSize); for (ulong i = 0; i < output.ExtentCount; i++) { IntPtr currentPtr = new IntPtr(dataPtr.Handle.ToInt64() + (int)(singleExtentSize * i)); output.Extents[i] = currentPtr.ToStructure <RETRIEVAL_POINTERS_EXTENT>(); } } // Make extents more readable for (ulong i = 0; i < output.ExtentCount; i++) { ulong startVcn = i == 0 ? output.StartingVcn : output.Extents[i - 1].NextVcn; ulong size = output.Extents[i].NextVcn - startVcn; FileExtentInfo extent = new FileExtentInfo(); extent.Size = size; extent.Vcn = startVcn; extent.Lcn = output.Extents[i].Lcn; extents.Add(extent); } if (lastError == 38) { // End of file reached break; } // Prep the start point for the next call input.StartingVcn = output.Extents[output.ExtentCount - 1].NextVcn; } while (lastError == 234); return(extents.ToArray()); }
//FsctlGetObjectId //FsctlGetReparsePoint /// <summary><see cref="http://msdn.microsoft.com/en-us/library/windows/desktop/dd405526(v=vs.85).aspx"/></summary> public RETRIEVAL_POINTER_BASE FileSystemGetRetrievalPointerBase() { return(DeviceIoControlHelper.InvokeIoControl <RETRIEVAL_POINTER_BASE>(Handle, IOControlCode.FsctlGetRetrievalPointerBase)); }
/// <summary><see cref="http://msdn.microsoft.com/en-us/library/windows/desktop/aa364569(v=vs.85).aspx"/></summary> public NTFS_VOLUME_DATA_BUFFER FileSystemGetNtfsVolumeData() { return(DeviceIoControlHelper.InvokeIoControl <NTFS_VOLUME_DATA_BUFFER>(Handle, IOControlCode.FsctlGetNtfsVolumeData)); }
/// <summary><see cref="https://msdn.microsoft.com/en-us/library/windows/desktop/aa364583(v=vs.85).aspx"/></summary> public USN_JOURNAL_DATA_V0 FileSystemQueryUsnJournal() { USN_JOURNAL_DATA_V0 res = DeviceIoControlHelper.InvokeIoControl <USN_JOURNAL_DATA_V0>(Handle, IOControlCode.FsctlQueryUsnJournal); return(res); }
/// <summary><see cref="http://msdn.microsoft.com/en-us/library/windows/desktop/aa365180(v=vs.85).aspx"/></summary> public PARTITION_INFORMATION_EX DiskGetPartitionInfoEx() { return(DeviceIoControlHelper.InvokeIoControl <PARTITION_INFORMATION_EX>(Handle, IOControlCode.DiskGetPartitionInfoEx)); }
/// <summary><see cref="http://msdn.microsoft.com/en-us/library/windows/desktop/aa365169(v=vs.85).aspx"/></summary> public DISK_GEOMETRY DiskGetDriveGeometry() { return(DeviceIoControlHelper.InvokeIoControl <DISK_GEOMETRY>(Handle, IOControlCode.DiskGetDriveGeometry)); }
/// <summary><see cref="http://msdn.microsoft.com/en-us/library/windows/desktop/hh706681(v=vs.85).aspx"/></summary> public GET_DISK_ATTRIBUTES DiskGetDiskAttributes() { return(DeviceIoControlHelper.InvokeIoControl <GET_DISK_ATTRIBUTES>(Handle, IOControlCode.DiskGetDiskAttributes)); }
//DiskSetCacheInformation //DiskDeleteDriveLayout //DiskFormatDrive //DiskSenseDevice //DiskCheckVerify //DiskMediaRemoval //DiskEjectMedia //DiskLoadMedia //DiskReserve //DiskRelease //DiskFindNewDevices //DiskCreateDisk /// <summary><see cref="http://msdn.microsoft.com/en-us/library/windows/desktop/aa365178(v=vs.85).aspx"/></summary> public long DiskGetLengthInfo() { return(DeviceIoControlHelper.InvokeIoControl <GET_LENGTH_INFORMATION>(Handle, IOControlCode.DiskGetLengthInfo).Length); }