none
DeviceIoControl fails

    Question

  • Hello,

       I can't seem to get either one of these DeviceIoControl function calls to work.  IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS returns 1 and the other returns 87.  What gives?  What am I missing.  The file system is NTFS.  Also, I'm trying to open C:.  However, if I open E: it works.  Could security settings be the cause?  I've tried with an admin account.  I'm running Windows XP Pro with service pack 3.

    		//------------------------------------------------------------------------------------------------
    		// Open the volume.
    		//------------------------------------------------------------------------------------------------
    		HANDLE fileHandle = CreateFile(_T("\\\\.\\PhysicalDrive0"), GENERIC_READ, FILE_SHARE_READ |
    		                FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL);
    		if (INVALID_HANDLE_VALUE == fileHandle)
    		{
    			_tprintf(_T("A call to CreateFile(...) failed; GetLastError() reported %d!\n"),
    			     GetLastError());
    			return 1;
    		}
    
    		//------------------------------------------------------------------------------------------------
    		// Obtain the physical drive; per MSDN documentation.
    		//------------------------------------------------------------------------------------------------
    		DWORD        bytesReturned = 0;
    		VOLUME_DISK_EXTENTS volumeDiskExtents;
    //		if (FALSE == DeviceIoControl(fileHandle, IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS, NULL, 0,
    //		               & volumeDiskExtents, sizeof (volumeDiskExtents), & bytesReturned,
    //		               NULL))
    		NTFS_VOLUME_DATA_BUFFER ntfsVolumeDataBuffer;
    		if (FALSE == DeviceIoControl(fileHandle, FSCTL_GET_NTFS_VOLUME_DATA, NULL, 0,
    		               & ntfsVolumeDataBuffer, sizeof (ntfsVolumeDataBuffer),
    		               & bytesReturned, NULL))
    		{
    			_tprintf(_T("A call to DeviceIoControl(...) failed; GetLastError() reported %d!\n"),
    			     GetLastError());
    			return 2;
    		}

     Thank you,

    • Moved by Yi Feng Li Wednesday, March 09, 2011 9:14 AM WDK issue (From:Visual C++ Language)
    Tuesday, March 08, 2011 1:35 AM

Answers

All replies

  • The WDK forum is at http://social.msdn.microsoft.com/Forums/is/wdk/threads

    The following is signature, not part of post
    Please mark the post answered your question as the answer, and mark other helpful posts as helpful, so they will appear differently to other users who are visiting your thread for the same problem.
    Visual C++ MVP
    Tuesday, March 08, 2011 3:20 AM
  • Change your CreateFile call to "CreateFile(_T("\\\\.\\C:"), ...)" You may also replace GENERIC_READ with 0.

     

    Also take a look at the sysinternals DiskExt utility: http://technet.microsoft.com/en-us/sysinternals/bb896648

    -PaulH

    Tuesday, March 08, 2011 11:10 PM
  • CodeFusion wrote:
    >
    >I can't seem to get either one of these DeviceIoControl function calls
    >to work. IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS returns 1 and the
    >other returns 87. What gives? What am I missing. The file system
    >is NTFS.
     
    To expand on Paul's reply, you aren't opening a file system here. You are
    opening a physical drive. The concepts (and the programming interfaces)
    are different.
     
    >Also, I'm trying to open C:.
     
    No, you are trying to open \\.\PhysicalDrive0. If you want to open C:,
    then open \\.\C: instead.
    --
    Tim Roberts, timr@probo.com
    Providenza & Boekelheide, Inc.
     

    Tim Roberts, DDK MVP
    Wednesday, March 09, 2011 8:02 AM
  • Thank you for the replies.  My goal is to parse the MFT, it seems as though I start off at the MFT but I'm having difficulty parsing it.  The first MFT entry begins with FILE0 (and I'm on an XP machine).  How does one know which headers to use when parsing the MFT?  After roughly 15 entries of 1024 bytes each subsequent reads no longer have FILE0 as their first entry?  Getting NTFS_VOLUME_DATA_BUFFER indicates file records are only 1024 bytes long, is this true?

    Thank you,

    Wednesday, March 09, 2011 4:22 PM