public unsafe MFT_FILE_INFO[] read(DriveInfo driveInfo) { string pathRoot = string.Concat(@"\\.\", driveInfo.Name.Substring(0, 2)); hVolume = Win32API.CreateFile( pathRoot, Win32API.GENERIC_READ | Win32API.GENERIC_WRITE, Win32API.FILE_SHARE_READ | Win32API.FILE_SHARE_WRITE, IntPtr.Zero, Win32API.OPEN_EXISTING, 0, IntPtr.Zero); if (hVolume.ToInt32() == Win32API.INVALID_HANDLE_VALUE) { Win32API.CloseHandle(hVolume); //Marshal.GetLastWin32Error return(new MFT_FILE_INFO[1]); } //Win32API.BOOT_BLOCK bb = new Win32API.BOOT_BLOCK(); IntPtr pbb = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(Win32API.BOOT_BLOCK))); //Win32API.ZeroMemory(pbb, Marshal.SizeOf(typeof(Win32API.BOOT_BLOCK))); //Marshal.StructureToPtr(bb, pbb, true); uint read = 0;; var readret = Win32API.ReadFile(hVolume, pbb, (uint)Marshal.SizeOf(typeof(Win32API.BOOT_BLOCK)), ref read, IntPtr.Zero); bootb = (Win32API.BOOT_BLOCK)Marshal.PtrToStructure(pbb, typeof(Win32API.BOOT_BLOCK)); LoadMFT(); //IntPtr pfile = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(Win32API.FILE_RECORD_HEADER))); Win32API.FILE_RECORD_HEADER * file = (Win32API.FILE_RECORD_HEADER *)MFT; Win32API.STANDARD_INFORMATION *sisec; for (ulong index = 0; index < 10; index++) { ReadFileRecord(index, file); Win32API.RECORD_ATTRIBUTE *attr = (Win32API.RECORD_ATTRIBUTE *)((byte *)file + file->AttributesOffset); if (file->Ntfs.Type == 1162627398) //'ELIF'){ { while (true) { if (attr->AttributeType < 0 || (int)attr->AttributeType > 0x100) { break; } switch (attr->AttributeType) { case Win32API.AttributeType.AttributeFileName: Win32API.RESIDENT_ATTRIBUTE *regsttr = (Win32API.RESIDENT_ATTRIBUTE *)attr; Win32API.FILENAME_ATTRIBUTE fattr = (Win32API.FILENAME_ATTRIBUTE)Marshal.PtrToStructure((IntPtr)((((byte *)attr) + regsttr->ValueOffset)), typeof(Win32API.FILENAME_ATTRIBUTE)); //fileinfos[i].ParentID = fattr.DirectoryFileReferenceNumber; //fileinfos[i].IsDirectory = ((p_file_record_header->Flags & 0x2) == 2); var n = fattr.Name; var s = fattr.DataSize; break; case Win32API.AttributeType.AttributeStandardInformation: //var off = (Win32API.RESIDENT_ATTRIBUTE*)attr; sisec = (Win32API.STANDARD_INFORMATION *)((byte *)attr + ((Win32API.RESIDENT_ATTRIBUTE *)attr)->ValueOffset); //Win32API.STANDARD_INFORMATION sattr = //(Win32API.STANDARD_INFORMATION)Marshal.PtrToStructure(new IntPtr(&attr + off->ValueOffset), typeof(Win32API.STANDARD_INFORMATION)); var ctiem = sisec->CreationTime; var lwtiem = sisec->LastWriteTime; //fileinfos[i].CreationTime = si->CreationTime; //fileinfos[i].LastWriteTime = si->LastWriteTime; break; case Win32API.AttributeType.AttributeData: if (attr->NonResident == 1) { //fileinfos[i].Size = ((Win32API.NONRESIDENT_ATTRIBUTE*)attr)->DataSize; } else { //fileinfos[i].Size = ((Win32API.RESIDENT_ATTRIBUTE*)attr)->ValueLength; } break; default: break; } if (attr->Length > 0 && attr->Length < file->BytesInUse) { attr = (Win32API.RECORD_ATTRIBUTE *)((byte *)attr + attr->Length); } else if (attr->NonResident == 1) //TRUE) { attr = (Win32API.RECORD_ATTRIBUTE *)((byte *)attr + sizeof(Win32API.NONRESIDENT_ATTRIBUTE)); } } } } Win32API.NTFS_VOLUME_DATA_BUFFER ntfsVolData = new Win32API.NTFS_VOLUME_DATA_BUFFER(); int ntfsVolDataSize = Marshal.SizeOf(ntfsVolData); IntPtr volBuffer = Marshal.AllocHGlobal(ntfsVolDataSize); //Win32API.ZeroMemory(volBuffer, ntfsVolDataSize); //Marshal.StructureToPtr(ntfsVolData, volBuffer, true); uint lpBytesReturned = 0; var ret = Win32API.DeviceIoControl( hVolume, Win32API.FSCTL_GET_NTFS_VOLUME_DATA, IntPtr.Zero, 0, volBuffer, ntfsVolDataSize, out lpBytesReturned, IntPtr.Zero); ntfsVolData = (Win32API.NTFS_VOLUME_DATA_BUFFER)Marshal.PtrToStructure(volBuffer, typeof(Win32API.NTFS_VOLUME_DATA_BUFFER)); Marshal.FreeHGlobal(volBuffer); if (ret) { //Console.WriteLine("Volume Serial Number: 0X%.8X%.8X\n", ntfsVolData.VolumeSerialNumber.HighPart, ntfsVolData.VolumeSerialNumber.LowPart); Console.WriteLine("The number of bytes in a cluster: {0}", ntfsVolData.BytesPerCluster); Console.WriteLine("The number of bytes in a file record segment: {0}", ntfsVolData.BytesPerFileRecordSegment); Console.WriteLine("The number of bytes in a sector: {0}", ntfsVolData.BytesPerSector); Console.WriteLine("The number of clusters in a file record segment: {0}", ntfsVolData.ClustersPerFileRecordSegment); Console.WriteLine("The number of free clusters in the specified volume: {0}", ntfsVolData.FreeClusters); //Console.WriteLine("The starting logical cluster number of the master file table mirror: 0X%.8X%.8X\n", ntfsVolData.Mft2StartLcn.HighPart, ntfsVolData.Mft2StartLcn.LowPart); //Console.WriteLine("The starting logical cluster number of the master file table: 0X%.8X%.8X\n", ntfsVolData.MftStartLcn.HighPart, ntfsVolData.MftStartLcn.LowPart); Console.WriteLine("The length of the master file table, in bytes: {0}", ntfsVolData.MftValidDataLength); //Console.WriteLine("The ending logical cluster number of the master file table zone: 0X%.8X%.8X\n", ntfsVolData.MftZoneEnd.HighPart, ntfsVolData.MftZoneEnd.LowPart); //Console.WriteLine("The starting logical cluster number of the master file table zone: 0X%.8X%.8X\n", ntfsVolData.MftZoneStart.HighPart, ntfsVolData.MftZoneStart.LowPart); Console.WriteLine("The number of sectors: {0}", ntfsVolData.NumberSectors); Console.WriteLine("Total Clusters (used and free): {0}", ntfsVolData.TotalClusters); Console.WriteLine("The number of reserved clusters: {0}\n", ntfsVolData.TotalReserved); } Int64 QuadPart = 1024; // 1024 or 2048 long total_file_count = (ntfsVolData.MftValidDataLength / QuadPart); //total_file_count = total_file_count / 1000; //test MFT_FILE_INFO[] fileinfos = new MFT_FILE_INFO[total_file_count]; Win32API.NTFS_FILE_RECORD_OUTPUT_BUFFER ob = new Win32API.NTFS_FILE_RECORD_OUTPUT_BUFFER(); int obSize = Marshal.SizeOf(ob) + ntfsVolData.BytesPerFileRecordSegment - 1; //int obSize = sizeof(Win32API.NTFS_FILE_RECORD_OUTPUT_BUFFER) + ntfsVolData.BytesPerFileRecordSegment - 1; Win32API.NTFS_FILE_RECORD_INPUT_BUFFER mftRecordInput = new Win32API.NTFS_FILE_RECORD_INPUT_BUFFER(); int mftRecordInputSize = Marshal.SizeOf(mftRecordInput); for (long i = 0; i < total_file_count; i++) { mftRecordInput.FileReferenceNumber = i; IntPtr input_buffer = Marshal.AllocHGlobal(mftRecordInputSize); Win32API.ZeroMemory(input_buffer, mftRecordInputSize); Marshal.StructureToPtr(mftRecordInput, input_buffer, true); IntPtr output_buffer = Marshal.AllocHGlobal(obSize); var bDioControl = Win32API.DeviceIoControl( hVolume, Win32API.FSCTL_GET_NTFS_FILE_RECORD, input_buffer, mftRecordInputSize, output_buffer, obSize, out lpBytesReturned, IntPtr.Zero); //fixed (Win32API.NTFS_FILE_RECORD_INPUT_BUFFER* ptr = (&mftRecordInput)) { // var bDioControl = Win32API.DeviceIoControl( // hVolume, // Win32API.FSCTL_GET_NTFS_FILE_RECORD, // (IntPtr)ptr, // mftRecordInputSize, // output_buffer, // obSize, // out lpBytesReturned, // IntPtr.Zero); //} Win32API.FILE_RECORD_HEADER *p_file_record_header; var outbuff = Win32API.NTFS_FILE_RECORD_OUTPUT_BUFFER.FromPtr(output_buffer); fixed(byte *ptr = &outbuff.FileRecordBuffer[0]) { p_file_record_header = (Win32API.FILE_RECORD_HEADER *)ptr; Win32API.RECORD_ATTRIBUTE *attr = (Win32API.RECORD_ATTRIBUTE *)((int)ptr + p_file_record_header->AttributesOffset); Win32API.STANDARD_INFORMATION *si; if (p_file_record_header->Ntfs.Type == 1162627398) //'ELIF'){ { while (true) { if (attr->AttributeType < 0 || (int)attr->AttributeType > 0x100) { break; } switch (attr->AttributeType) { case Win32API.AttributeType.AttributeFileName: Win32API.RESIDENT_ATTRIBUTE *regsttr = (Win32API.RESIDENT_ATTRIBUTE *)attr; Win32API.FILENAME_ATTRIBUTE fattr = (Win32API.FILENAME_ATTRIBUTE)Marshal.PtrToStructure((IntPtr)((((byte *)attr) + regsttr->ValueOffset)), typeof(Win32API.FILENAME_ATTRIBUTE)); fileinfos[i].ParentID = fattr.DirectoryFileReferenceNumber; fileinfos[i].IsDirectory = ((p_file_record_header->Flags & 0x2) == 2); //fileinfos[i].Name = fattr.Name; fileinfos[i].Size = fattr.DataSize; break; case Win32API.AttributeType.AttributeStandardInformation: //var off = (Win32API.RESIDENT_ATTRIBUTE*)attr; si = (Win32API.STANDARD_INFORMATION *)((byte *)attr + ((Win32API.RESIDENT_ATTRIBUTE *)attr)->ValueOffset); //Win32API.STANDARD_INFORMATION sattr = //(Win32API.STANDARD_INFORMATION)Marshal.PtrToStructure(new IntPtr(&attr + off->ValueOffset), typeof(Win32API.STANDARD_INFORMATION)); //var ctiem = si->CreationTime; //var lwtiem = si->LastWriteTime; fileinfos[i].CreationTime = si->CreationTime; fileinfos[i].LastWriteTime = si->LastWriteTime; break; case Win32API.AttributeType.AttributeData: if (attr->NonResident == 1) { fileinfos[i].Size = ((Win32API.NONRESIDENT_ATTRIBUTE *)attr)->DataSize; } else { fileinfos[i].Size = ((Win32API.RESIDENT_ATTRIBUTE *)attr)->ValueLength; } break; default: break; } if (attr->Length > 0 && attr->Length < p_file_record_header->BytesInUse) { attr = (Win32API.RECORD_ATTRIBUTE *)((byte *)attr + attr->Length); } else if (attr->NonResident == 1) //TRUE) { attr = (Win32API.RECORD_ATTRIBUTE *)((byte *)attr + sizeof(Win32API.NONRESIDENT_ATTRIBUTE)); } } //if (fileinfos[i].Name != null && fileinfos[i].Name.Contains("wv.ncb")) { // var f = fileinfos[i]; // var ss = f.Size; // int h = 0; //} } } Marshal.FreeHGlobal(output_buffer); Marshal.FreeHGlobal(input_buffer); } Win32API.CloseHandle(hVolume); return(fileinfos); }
public unsafe MFT_FILE_INFO[] read(DriveInfo driveInfo) { string pathRoot = string.Concat(@"\\.\", driveInfo.Name.Substring(0, 2)); hVolume = Win32API.CreateFile( pathRoot, Win32API.GENERIC_READ | Win32API.GENERIC_WRITE, Win32API.FILE_SHARE_READ | Win32API.FILE_SHARE_WRITE, IntPtr.Zero, Win32API.OPEN_EXISTING, 0, IntPtr.Zero); if (hVolume.ToInt32() == Win32API.INVALID_HANDLE_VALUE) { Win32API.CloseHandle(hVolume); //Marshal.GetLastWin32Error return new MFT_FILE_INFO[1]; } //Win32API.BOOT_BLOCK bb = new Win32API.BOOT_BLOCK(); IntPtr pbb = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(Win32API.BOOT_BLOCK))); //Win32API.ZeroMemory(pbb, Marshal.SizeOf(typeof(Win32API.BOOT_BLOCK))); //Marshal.StructureToPtr(bb, pbb, true); uint read=0;; var readret = Win32API.ReadFile(hVolume, pbb, (uint)Marshal.SizeOf(typeof(Win32API.BOOT_BLOCK)), ref read, IntPtr.Zero); bootb = (Win32API.BOOT_BLOCK)Marshal.PtrToStructure(pbb, typeof(Win32API.BOOT_BLOCK)); LoadMFT(); //IntPtr pfile = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(Win32API.FILE_RECORD_HEADER))); Win32API.FILE_RECORD_HEADER* file = (Win32API.FILE_RECORD_HEADER*)MFT; Win32API.STANDARD_INFORMATION* sisec; for (ulong index = 0; index < 10; index++) { ReadFileRecord(index, file); Win32API.RECORD_ATTRIBUTE* attr = (Win32API.RECORD_ATTRIBUTE*)((byte*)file + file->AttributesOffset); if (file->Ntfs.Type == 1162627398) {//'ELIF'){ while (true) { if (attr->AttributeType < 0 || (int)attr->AttributeType > 0x100) break; switch (attr->AttributeType) { case Win32API.AttributeType.AttributeFileName: Win32API.RESIDENT_ATTRIBUTE* regsttr = (Win32API.RESIDENT_ATTRIBUTE*)attr; Win32API.FILENAME_ATTRIBUTE fattr = (Win32API.FILENAME_ATTRIBUTE)Marshal.PtrToStructure((IntPtr)((((byte*)attr) + regsttr->ValueOffset)), typeof(Win32API.FILENAME_ATTRIBUTE)); //fileinfos[i].ParentID = fattr.DirectoryFileReferenceNumber; //fileinfos[i].IsDirectory = ((p_file_record_header->Flags & 0x2) == 2); var n = fattr.Name; var s = fattr.DataSize; break; case Win32API.AttributeType.AttributeStandardInformation: //var off = (Win32API.RESIDENT_ATTRIBUTE*)attr; sisec = (Win32API.STANDARD_INFORMATION*)((byte*)attr + ((Win32API.RESIDENT_ATTRIBUTE*)attr)->ValueOffset); //Win32API.STANDARD_INFORMATION sattr = //(Win32API.STANDARD_INFORMATION)Marshal.PtrToStructure(new IntPtr(&attr + off->ValueOffset), typeof(Win32API.STANDARD_INFORMATION)); var ctiem = sisec->CreationTime; var lwtiem = sisec->LastWriteTime; //fileinfos[i].CreationTime = si->CreationTime; //fileinfos[i].LastWriteTime = si->LastWriteTime; break; case Win32API.AttributeType.AttributeData: if (attr->NonResident == 1) { //fileinfos[i].Size = ((Win32API.NONRESIDENT_ATTRIBUTE*)attr)->DataSize; } else { //fileinfos[i].Size = ((Win32API.RESIDENT_ATTRIBUTE*)attr)->ValueLength; } break; default: break; } if (attr->Length > 0 && attr->Length < file->BytesInUse) attr = (Win32API.RECORD_ATTRIBUTE*)((byte*)attr + attr->Length); else if (attr->NonResident == 1)//TRUE) attr = (Win32API.RECORD_ATTRIBUTE*)((byte*)attr + sizeof(Win32API.NONRESIDENT_ATTRIBUTE)); } } } Win32API.NTFS_VOLUME_DATA_BUFFER ntfsVolData = new Win32API.NTFS_VOLUME_DATA_BUFFER(); int ntfsVolDataSize = Marshal.SizeOf(ntfsVolData); IntPtr volBuffer = Marshal.AllocHGlobal(ntfsVolDataSize); //Win32API.ZeroMemory(volBuffer, ntfsVolDataSize); //Marshal.StructureToPtr(ntfsVolData, volBuffer, true); uint lpBytesReturned = 0; var ret = Win32API.DeviceIoControl( hVolume, Win32API.FSCTL_GET_NTFS_VOLUME_DATA, IntPtr.Zero, 0, volBuffer, ntfsVolDataSize, out lpBytesReturned, IntPtr.Zero); ntfsVolData = (Win32API.NTFS_VOLUME_DATA_BUFFER)Marshal.PtrToStructure(volBuffer, typeof(Win32API.NTFS_VOLUME_DATA_BUFFER)); Marshal.FreeHGlobal(volBuffer); if (ret) { //Console.WriteLine("Volume Serial Number: 0X%.8X%.8X\n", ntfsVolData.VolumeSerialNumber.HighPart, ntfsVolData.VolumeSerialNumber.LowPart); Console.WriteLine("The number of bytes in a cluster: {0}", ntfsVolData.BytesPerCluster); Console.WriteLine("The number of bytes in a file record segment: {0}", ntfsVolData.BytesPerFileRecordSegment); Console.WriteLine("The number of bytes in a sector: {0}", ntfsVolData.BytesPerSector); Console.WriteLine("The number of clusters in a file record segment: {0}", ntfsVolData.ClustersPerFileRecordSegment); Console.WriteLine("The number of free clusters in the specified volume: {0}", ntfsVolData.FreeClusters); //Console.WriteLine("The starting logical cluster number of the master file table mirror: 0X%.8X%.8X\n", ntfsVolData.Mft2StartLcn.HighPart, ntfsVolData.Mft2StartLcn.LowPart); //Console.WriteLine("The starting logical cluster number of the master file table: 0X%.8X%.8X\n", ntfsVolData.MftStartLcn.HighPart, ntfsVolData.MftStartLcn.LowPart); Console.WriteLine("The length of the master file table, in bytes: {0}", ntfsVolData.MftValidDataLength); //Console.WriteLine("The ending logical cluster number of the master file table zone: 0X%.8X%.8X\n", ntfsVolData.MftZoneEnd.HighPart, ntfsVolData.MftZoneEnd.LowPart); //Console.WriteLine("The starting logical cluster number of the master file table zone: 0X%.8X%.8X\n", ntfsVolData.MftZoneStart.HighPart, ntfsVolData.MftZoneStart.LowPart); Console.WriteLine("The number of sectors: {0}", ntfsVolData.NumberSectors); Console.WriteLine("Total Clusters (used and free): {0}", ntfsVolData.TotalClusters); Console.WriteLine("The number of reserved clusters: {0}\n", ntfsVolData.TotalReserved); } Int64 QuadPart = 1024; // 1024 or 2048 long total_file_count = (ntfsVolData.MftValidDataLength / QuadPart); //total_file_count = total_file_count / 1000; //test MFT_FILE_INFO[] fileinfos = new MFT_FILE_INFO[total_file_count]; Win32API.NTFS_FILE_RECORD_OUTPUT_BUFFER ob = new Win32API.NTFS_FILE_RECORD_OUTPUT_BUFFER(); int obSize = Marshal.SizeOf(ob) + ntfsVolData.BytesPerFileRecordSegment - 1; //int obSize = sizeof(Win32API.NTFS_FILE_RECORD_OUTPUT_BUFFER) + ntfsVolData.BytesPerFileRecordSegment - 1; Win32API.NTFS_FILE_RECORD_INPUT_BUFFER mftRecordInput = new Win32API.NTFS_FILE_RECORD_INPUT_BUFFER(); int mftRecordInputSize = Marshal.SizeOf(mftRecordInput); for (long i = 0; i < total_file_count; i++) { mftRecordInput.FileReferenceNumber = i; IntPtr input_buffer = Marshal.AllocHGlobal(mftRecordInputSize); Win32API.ZeroMemory(input_buffer, mftRecordInputSize); Marshal.StructureToPtr(mftRecordInput, input_buffer, true); IntPtr output_buffer = Marshal.AllocHGlobal(obSize); var bDioControl = Win32API.DeviceIoControl( hVolume, Win32API.FSCTL_GET_NTFS_FILE_RECORD, input_buffer, mftRecordInputSize, output_buffer, obSize, out lpBytesReturned, IntPtr.Zero); //fixed (Win32API.NTFS_FILE_RECORD_INPUT_BUFFER* ptr = (&mftRecordInput)) { // var bDioControl = Win32API.DeviceIoControl( // hVolume, // Win32API.FSCTL_GET_NTFS_FILE_RECORD, // (IntPtr)ptr, // mftRecordInputSize, // output_buffer, // obSize, // out lpBytesReturned, // IntPtr.Zero); //} Win32API.FILE_RECORD_HEADER* p_file_record_header; var outbuff = Win32API.NTFS_FILE_RECORD_OUTPUT_BUFFER.FromPtr(output_buffer); fixed (byte* ptr = &outbuff.FileRecordBuffer[0]) { p_file_record_header = (Win32API.FILE_RECORD_HEADER*)ptr; Win32API.RECORD_ATTRIBUTE* attr = (Win32API.RECORD_ATTRIBUTE*)((int)ptr + p_file_record_header->AttributesOffset); Win32API.STANDARD_INFORMATION* si; if (p_file_record_header->Ntfs.Type == 1162627398) {//'ELIF'){ while (true) { if (attr->AttributeType < 0 || (int)attr->AttributeType > 0x100) break; switch (attr->AttributeType) { case Win32API.AttributeType.AttributeFileName: Win32API.RESIDENT_ATTRIBUTE* regsttr = (Win32API.RESIDENT_ATTRIBUTE*)attr; Win32API.FILENAME_ATTRIBUTE fattr = (Win32API.FILENAME_ATTRIBUTE)Marshal.PtrToStructure((IntPtr)((((byte*)attr) + regsttr->ValueOffset)), typeof(Win32API.FILENAME_ATTRIBUTE)); fileinfos[i].ParentID = fattr.DirectoryFileReferenceNumber; fileinfos[i].IsDirectory = ((p_file_record_header->Flags & 0x2) == 2); //fileinfos[i].Name = fattr.Name; fileinfos[i].Size = fattr.DataSize; break; case Win32API.AttributeType.AttributeStandardInformation: //var off = (Win32API.RESIDENT_ATTRIBUTE*)attr; si = (Win32API.STANDARD_INFORMATION*)((byte*)attr + ((Win32API.RESIDENT_ATTRIBUTE*)attr)->ValueOffset); //Win32API.STANDARD_INFORMATION sattr = //(Win32API.STANDARD_INFORMATION)Marshal.PtrToStructure(new IntPtr(&attr + off->ValueOffset), typeof(Win32API.STANDARD_INFORMATION)); //var ctiem = si->CreationTime; //var lwtiem = si->LastWriteTime; fileinfos[i].CreationTime = si->CreationTime; fileinfos[i].LastWriteTime = si->LastWriteTime; break; case Win32API.AttributeType.AttributeData: if (attr->NonResident == 1) { fileinfos[i].Size = ((Win32API.NONRESIDENT_ATTRIBUTE*)attr)->DataSize; } else { fileinfos[i].Size = ((Win32API.RESIDENT_ATTRIBUTE*)attr)->ValueLength; } break; default: break; } if (attr->Length > 0 && attr->Length < p_file_record_header->BytesInUse) attr = (Win32API.RECORD_ATTRIBUTE*)((byte*)attr + attr->Length); else if (attr->NonResident == 1)//TRUE) attr = (Win32API.RECORD_ATTRIBUTE*)((byte*)attr + sizeof(Win32API.NONRESIDENT_ATTRIBUTE)); } //if (fileinfos[i].Name != null && fileinfos[i].Name.Contains("wv.ncb")) { // var f = fileinfos[i]; // var ss = f.Size; // int h = 0; //} } } Marshal.FreeHGlobal(output_buffer); Marshal.FreeHGlobal(input_buffer); } Win32API.CloseHandle(hVolume); return fileinfos; }