Reading MFT

I forgot to mention that you have to be careful especially for x64 or AnyCPU compiled. For example a pointer is 4 bytes when your process is running under x86 and pointer is 8 bytes when running process under x64. There could be an issue with your pointers especially if you have some code that converts to Integer as in...

Consider the following when your running your code under AnyCPU or x64 builds.

path = Marshal.PtrToStringUni(new IntPtr(buffer.ToInt32() + 4), nameLength / 2);

should be

path = Marshal.PtrToStringUni(new IntPtr(buffer.ToInt64() + 4), nameLength / 2);

// OR

If IntPtr.Size = 4 Then
'// use ToInt32() version
End If

If IntPtr.Size = 8 Then
'// Use ToIntt64() version
End If