Reading MFT

Hi,

I am stopping in to share a how to calculate the progress when enumerating the MFT with FSCTL_ENUM_USN_DATA. In the DeviceIoControl call you specify a buffer that is to be filled with UsnRecords but in order to calculate the progress we would have to know the size of the Master File Table.. That is where you can use FSCTL_GET_NTFS_VOLUME_DATA. In addition it also gives you the NTFS Minor and Major version if you pass a large enough buffer. Take notice to the member in BOLD. (MftValidDataLength) well there you have it. You can use this to calculate progress based on the supplied buffer you use when calling FSCTL_ENUM_USN_DATA. In addition you can determine if the operation will take longer than expected. For example my C:\ drives MFT length is 332MB but my other partition E:\ has only 22MB. Your application can use this to determine how to process records but the most important part is providing a percentage which is useful when populating the database. Enjoy!

typedefstruct {
 LARGE_INTEGER VolumeSerialNumber;
 LARGE_INTEGER NumberSectors;
 LARGE_INTEGER TotalClusters;
 LARGE_INTEGER FreeClusters;
 LARGE_INTEGER TotalReserved;
 DWORD     BytesPerSector;
 DWORD     BytesPerCluster;
 DWORD     BytesPerFileRecordSegment;
 DWORD     ClustersPerFileRecordSegment;
 LARGE_INTEGER <strong>MftValidDataLength</strong>;
 LARGE_INTEGER MftStartLcn;
 LARGE_INTEGER Mft2StartLcn;
 LARGE_INTEGER MftZoneStart;
 LARGE_INTEGER MftZoneEnd;
} NTFS_VOLUME_DATA_BUFFER, *PNTFS_VOLUME_DATA_BUFFER;