I just got back from an 8 day hiking trip through Wyoming's Wind Rivers Wilderness area. So I have just started to catch up on email and other details. Caught a lot of fish, saw some great country, had some time to myself.
As for your issue.
My organization was a little different. I have a class called EnumerateVolume which uses the class PInvokeWin32. PInvokeWin32 is simply a class that gives C# the ability to call the low level functions to deal with the MFT.
That said, GetRootFrnEntry() in my code is in the EnumerateVolume class. Yours seems to be in the PInvokeWin32 class. That's fine. My function uses a member variable called _drive which is of the form \\.\ + _drive. I'd have to look it up to see what I do to the simple drive letter c, c: to see what the exact format is. I think it is c:.
The GetRootFrnEntry() function adds the \\.\ and appends the directory separator character (\). The intent of the function is to "open a file that is the root directory" of the disk volume. I posted the code for this routine.
So the problem is to build a dictionary of "File Reference Numbers" associated with their file names and Parent file reference numbers. The information in the mft contains only file reference numbers for the parents and somehow you have to build a path to the file unless all you want is the file name. You could call another low level function and given an FRN, get the file name and parent frn. But that would require another io.
The ulong of the root's parent is zero (0) which stops the recursion through the dictionary at the root. GetRootFrnEntry() purpose is simply to set up the root's entry in the dictionary.
That said, I'm not sure I answered your question. Hope I shed some light on your problem.
p.s. I think I mentioned I didn't like the name FileNameAndFrn. It should have been FileNameAndParentFrn which more precisely defines what the structure/class is about.
As for your issue.
My organization was a little different. I have a class called EnumerateVolume which uses the class PInvokeWin32. PInvokeWin32 is simply a class that gives C# the ability to call the low level functions to deal with the MFT.
That said, GetRootFrnEntry() in my code is in the EnumerateVolume class. Yours seems to be in the PInvokeWin32 class. That's fine. My function uses a member variable called _drive which is of the form \\.\ + _drive. I'd have to look it up to see what I do to the simple drive letter c, c: to see what the exact format is. I think it is c:.
The GetRootFrnEntry() function adds the \\.\ and appends the directory separator character (\). The intent of the function is to "open a file that is the root directory" of the disk volume. I posted the code for this routine.
So the problem is to build a dictionary of "File Reference Numbers" associated with their file names and Parent file reference numbers. The information in the mft contains only file reference numbers for the parents and somehow you have to build a path to the file unless all you want is the file name. You could call another low level function and given an FRN, get the file name and parent frn. But that would require another io.
The ulong of the root's parent is zero (0) which stops the recursion through the dictionary at the root. GetRootFrnEntry() purpose is simply to set up the root's entry in the dictionary.
That said, I'm not sure I answered your question. Hope I shed some light on your problem.
p.s. I think I mentioned I didn't like the name FileNameAndFrn. It should have been FileNameAndParentFrn which more precisely defines what the structure/class is about.