Reading MFT

First, I disagree with your edit...

Log.Info(e.Message, e);

Exception innerException = e.InnerException;

while (innerException != null)

{

Log.Info(innerException.Message, innerException);

innerExceptioninnerException = innerException.InnerException;

}

In .net, each Exception object has an inner exception.  The inner exception object is either another Exception object or null. This code should iterate through all of these nested exceptions until it finds a null inner exception.  The code you editted shouldn't compile...
There is no type 'innerException' and if there were you couldn't have a variable with a type name..  So I don't understand your edit.

This code should be:

Log.Info(e.Message, e);

Exception innerException = e.InnerException;

while (innerException != null)

{

Log.Info(innerException.Message, innerException);

innerException = innerException.InnerException;

}   as it was before your edit! I think we shouldn't be editing one another's code.  If you want to make suggestions for edits, fine but I'll edit my own code thanks.  The code you've edited makes no sense and now it has my name on it...

As for the undefined variables...  You can use whatever you like that works. 

_directories is a collection of each directory's 64-bit file reference number associated with the directory's  "FileNameAndFrn" object (which should have been called "FileNameAndParentFrn" for clarity which it is in my code. The code I posted was ancient personal code.) I used a dictionary.

_drive is simply

publicstring Drive

{

get { return _drive; }

}

Hard to figure that one out.


and _changeJournalRootHandle is

privateIntPtr _changeJournalRootHandle;

Which I thought was pretty simple to figure out because

private void GetRootHandle()

{

string vol = string.Concat("\\\\.\\", _drive);

_changeJournalRootHandle = PInvokeWin32.CreateFile(vol,

PInvokeWin32.GENERIC_READ | PInvokeWin32.GENERIC_WRITE,

PInvokeWin32.FILE_SHARE_READ | PInvokeWin32.FILE_SHARE_WRITE,

IntPtr.Zero,

PInvokeWin32.OPEN_EXISTING,

0,

IntPtr.Zero);

if (_changeJournalRootHandle.ToInt32() == PInvokeWin32.INVALID_HANDLE_VALUE)

{

throw new IOException("CreateFile() returned invalid handle",

new Win32Exception(Marshal.GetLastWin32Error()));

}

}

shows _changeJournalRootHandle as the return from PInvokeWin32.CreateFile() which is defined as 

[DllImport("kernel32.dll", SetLastError = true)]

public static extern IntPtr CreateFile(string lpFileName, uint dwDesiredAccess,

uint dwShareMode, IntPtr lpSecurityAttributes,

uint dwCreationDisposition, uint dwFlagsAndAttributes,

IntPtr hTemplateFile);   in the code I provided.

So, I'm a little disconcerted that you simply didn't try to understand the code I provided.  I didn't intend to write a turnkey,  black box object that would automatically work.  I only wanted to provide the ideas that others could build on to accomplish enumerating the files using the MFT in c#.  Explaining at this level wasn't my intent.