Hey,

Sorry, if this is too much of a doublepost, but seems like the other thread is "forgotten"... ( Re: Accessing a RAW partition! ) Usually, the feedback is rather quick, but no reply yet, so seems forgotten... anyway, I've managed to come this far (and Im quite stuck atm):

use Win32API::File qw /:Func :IOCTL_DISK_ :MEDIA_TYPE :Misc/;
use Data::Dumper;

use strict;
use warnings;
use diagnostics;

my $sDosDeviceName = [];
my $osTargetPath;
my @devices = Win32API::File::QueryDosDevice($sDosDeviceName, $osTarge
+tPath, []) or  die "Can't open: $^E\n";

print Dumper($sDosDeviceName);

#foreach (@devices) {
#    print $_ . "\n";
#}

my $hObject = createFile( "//./PhysicalDrive3", "r", "rw")
                            or  die "Can't open: $^E\n";

#Usage: Win32API::File::DeviceIoControl(hDevice, uIoControlCode, pInBu
+f, lInBuf, opOutBuf, lOutBuf, olRetBytes, pOverlapped)
my $opOutBuf;
my $olRetBytes;
Win32API::File::DeviceIoControl($hObject, IOCTL_DISK_GET_DRIVE_GEOMETR
+Y, [], 0, $opOutBuf, [], $olRetBytes, []);

# Calculate the number of DISK_GEOMETRY structures returned:
my $cStructs = length($opOutBuf)/(4+4+4+4+4+4);
my @fields = unpack( "L l I L L L" x $cStructs, $opOutBuf );

my( @ucCylsLow, @ivcCylsHigh, @uMediaType, @uTracksPerCyl, @uSectsPerT
+rack, @uBytesPerSect ) = ();

print Dumper(@fields);

my $ucCylsLow = shift @fields;
my $ivcCylsHigh = shift @fields;
my $uMediaType = shift @fields;
my $uTracksPerCyl = shift @fields;
my $uSectsPerTrack = shift @fields;
my $uBytesPerSect = shift @fields;

if ($uMediaType eq FixedMedia) {
    print "FixedMedia";
}
[download]

Comments?

Well, so far it seems good (although I cant make QueryDosDevice to work!)... But next step? To actually read sector by sector? And to get the data out as hex (and then easly to readable string)...

(I've had some help from http://msdn.microsoft.com/library/default.asp?url=/library/en-us/devio/base/calling_deviceiocontrol.asp )

Clearence: Ok, to clear up what the point of all this is... I can only access my hd "raw". There is data on it, and I want to extract text (gonna use regexp etc...), and thus I need to be able of reading from it.

We have: ReadFile( $hFile, $opBuffer, $lBytes, $olBytesRead, pOverlapped ) but Im not sure what to do with it...

And according to Microsoft:
"You can open a physical or logical drive using the CreateFile() application programming interface (API) with these device names provided that you have the appropriate access rights to the drive (that is, you must be an administrator). You must use both the CreateFile() FILE_SHARE_READ and FILE_SHARE_WRITE flags to gain access to the drive.

Once the logical or physical drive has been opened, you can then perform direct I/O to the data on the entire drive. When performing direct disk I/O, you must seek, read, and write in multiples of sector sizes of the device and on sector boundaries. Call DeviceIoControl() using IOCTL_DISK_GET_DRIVE_GEOMETRY to get the bytes per sector, number of sectors, sectors per track, and so forth, so that you can compute the size of the buffer that you will need."

http://support.microsoft.com/kb/q100027/

I've done the first part. Now, how to read?

UPDATE: Dont tell me its as easy as:

my ($opBuffer, $lBytes, $olBytesRead);
$lBytes = $uBytesPerSect;
my $bool = ReadFile( $hObject, $opBuffer, $lBytes, $olBytesRead, []);
[download]

UPDATE 2: $ivcCylsHigh is 0 here. That can't be right!
Also, Im not sure about: setFilePointer( $hFile, $ivOffset, $ioivOffsetHigh, $uFromWhere ); I did:

my $ivOffset = 25096704;
my $uNewPos = SetFilePointer( $hObject, $ivOffset, [], FILE_CURRENT );
+ # change to use Win32API::File qw /:Func :IOCTL_DISK_ :MEDIA_TYPE :M
+isc/;
[download]

and it seems ok, but if I compare the printout, with HxD, its not the same...

    if ($bool) {
        print $opBuffer . "\n";
    }
    else {
        print "ERROR: $^E\n";
    }
[download]

maybe I need to do some tricks to get the _right_ data... although it does seem like right data (no need to convert to hex or shift because of some wierd reason).

Thanks,
Ace

edit (broquaint): Made URLs into links.