如何从 NTFS 中的 $MFT 文件中访问文件每个块的文件指针？

Question

我正在从事文件虚拟化和版本控制项目。为此，我需要直接访问文件内容的逻辑块，而不需要复制到内存中。任何人都可以帮助我使用适用于我的 64 位 Windows 的代码 sn-ps 吗？

我尝试了以下代码来访问 MFT 文件。但即使我以管理员权限运行，它也会像“拒绝访问”一样响应。

#include<windows.h>
#include<stdio.h>
#include<winioctl.h>
// Format the Win32 system error code to string
void ErrorMessage(DWORD dwCode);
int wmain(int argc, WCHAR **argv){
    HANDLE hVolume;
    WCHAR lpDrive[] = L"\\\\.\\C:";
    PNTFS_VOLUME_DATA_BUFFER ntfsVolData = {0};
    BOOL bDioControl = FALSE;
    DWORD dwWritten = 0;

    hVolume = CreateFile(lpDrive, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE,NULL,OPEN_EXISTING,0,NULL);

    if(hVolume == INVALID_HANDLE_VALUE){
        wprintf(L"CreateFile() failed!\n");
        ErrorMessage(GetLastError());
        if(CloseHandle(hVolume) != 0)
            wprintf(L"hVolume handle was closed successfully!\n");
        else{
            wprintf(L"Failed to close hVolume handle!\n");
            ErrorMessage(GetLastError());
            }
        }
        else
            wprintf(L"CreateFile() is pretty fine!\n");
            ntfsVolData = (PNTFS_VOLUME_DATA_BUFFER)malloc(sizeof(NTFS_VOLUME_DATA_BUFFER)+sizeof(NTFS_EXTENDED_VOLUME_DATA));

        bDioControl = DeviceIoControl(hVolume, FSCTL_GET_NTFS_VOLUME_DATA, NULL, 0, ntfsVolData,sizeof(NTFS_VOLUME_DATA_BUFFER)+sizeof(NTFS_EXTENDED_VOLUME_DATA), &dwWritten, NULL);
        if(bDioControl == 0){
            wprintf(L"DeviceIoControl() failed!\n");
            ErrorMessage(GetLastError());
            if(CloseHandle(hVolume) != 0)
                wprintf(L"hVolume handle was closed successfully!\n");
            else{
                wprintf(L"Failed to close hVolume handle!\n");
                ErrorMessage(GetLastError());
                }

        }


    getchar();
}

void ErrorMessage(DWORD dwCode){
    DWORD dwErrCode = dwCode;
    DWORD dwNumChar;
    LPWSTR szErrString = NULL;  // will be allocated and filled by FormatMessage
    dwNumChar = FormatMessage( FORMAT_MESSAGE_ALLOCATE_BUFFER |FORMAT_MESSAGE_FROM_SYSTEM, 0, dwErrCode, 0,     (LPWSTR)&szErrString, 0,0 );               // since getting message from system tables
    if(dwNumChar == 0)wprintf(L"FormatMessage() failed, error %u\n", GetLastError());//else//wprintf(L"FormatMessage() should be fine!\n");
    wprintf(L"Error code %u:\n  %s\n", dwErrCode, szErrString) ;// This buffer used by FormatMessage()
    if(LocalFree(szErrString) != NULL)
    wprintf(L"Failed to free up the buffer, error %u\n", GetLastError());//else//wprintf(L"Buffer has been freed\n");
    }

CreateFile() failed!
Error code 5:
  Access is denied.

hVolume handle was closed successfully!
DeviceIoControl() failed!
Error code 6:
  The handle is invalid.

hVolume handle was closed successfully!

谢谢

Answer 1

管理员权限是不够的。您需要做的是为您的进程请求备份和恢复权限。 MSDN 有sample code。请记住，您可能同时需要 SE_BACKUP_NAME 和 SE_RESTORE_NAME。

过程有点繁琐：

1. 在您的进程中使用OpenProcessToken 和TOKEN_ADJUST_PRIVILEGES
2. 使用LookupPrivilegeValue根据字符串常量获取权限（SE_BACKUP_NAME一个，SE_RESTORE_NAME一个）
3. 使用AdjustTokenPrivileges 获取备份和恢复权限

如果您正确执行此操作，则其余代码应该可以工作。要实际枚举 MFT，您需要使用 DeviceIOControl 的 FSCTL_ENUM_USN_DATA 变体。