Getting MFT info from NTFS!

Ace128 has asked for the wisdom of the Perl Monks concerning the following question:

Hey!

Loving Perl as we all do I was looking for a way getting the MFT info out from a NTFS filessystem! I just love these kind of hacks! :) I have been googleing (yes, that is a word nowadays? :) ) around but its hard. Specially since how NTFS works is supposed to be secret... Now, I have found some linux tools for NTFS, but I thought that before I deepdive into the sourcecode, I ask here to see if anyone here have any nice points and maybe can make my progress faster!

Amoung those I've found are:

http://wiki.linux-ntfs.org/doku.php?id=ntfsinfo
http://www.ntfs.com/ntfs_basics.htm
http://linux-ntfs.sourceforge.net/ntfs/files/mft.html
http://wiki.linux-ntfs.org/doku.php?id=ntfsprogs
http://fuse.sourceforge.net/
http://www.codeproject.com/file/

As a side note I can mention that I have created a tool in Perl using Win32::API to access a hd RAW and recover data! Im not sure, but maybe there is something in the Windows API that enables me to get the MFT info (although I couldnt find it on MSDN).

So, Im wondering if anyone here can give some help on how to progress? Should I dive into the source code of linux-ntfs (ntfsinfo) and try to convert that to Perl? Basicly, I wanna know on what sectors a file is at on the harddrive!

UPDATE: Hey, found this: http://www.codeproject.com/file/NTFSUndelete.asp

Thanks,
Ace

Comment on Getting MFT info from NTFS!

Replies are listed 'Best First'.
Re: Getting MFT info from NTFS! by esskar (Deacon) on Jan 16, 2006 at 10:17 UTC
Hi, i'm not sure which information you want but i know of the NTFS_STATISTICS structure. Use the controlcode FSCTL_FILESYSTEM_GET_STATISTICS for querying this information HTH	[reply]
Re^2: Getting MFT info from NTFS! by Ace128 (Hermit) on Jan 16, 2006 at 11:33 UTC
Well, basicly I wanna get all sectors (in right order aswell) a file lies in on hd! Since I made an application in Perl to read raw, it would be even more nice if I could get that info out (in case of a crasch, I could have that information saved somewhere, eventhough the ntfs mtf is gone. You know, even if the filestructure is gone, data may still be recoverable!) So, I wanna find a way to get that out _before_ its too late! This is ofcource specially needed when the hd is fragmented. Else there is no real problem...	[reply]
Re: Getting MFT info from NTFS! by Ace128 (Hermit) on Feb 03, 2006 at 08:53 UTC
Still noone that can help?	[reply]
Re^2: Getting MFT info from NTFS! by Anonymous Monk on Sep 20, 2010 at 09:41 UTC
Hi Ace, I am also having the same type of requirement and facing the problem to find right tool. Have you got any success to get each cluster/block information of NTFS. Please let me know. Thanks, Amol	[reply]
Re^3: Getting MFT info from NTFS! by Anonymous Monk on Sep 27, 2010 at 12:31 UTC
I'm struggling with the same problem. I need to be able to quickly determine the files / directories on an NTFS drive (without traversing directory tree) and then be able to iterate through those file entries reading the sectors that hold the files data. Any help would be very much appreciated.	[reply]


laziness, impatience, and hubris
	PerlMonks