0

Does anyone know how to get the cluster/block no. of $BITMAP file from MFT in C/C++? I know the file record number of $BITMAP file in MFT is 6, but how can I know its sector or block/cluster no.? Actually I want to read the $Bitmap file.

Note: I don't want to use Windows API.

Awaiting a positive response. Thanks in advance.

Roman R.
  • 68,205
  • 6
  • 94
  • 158
user3395981
  • 41
  • 5
  • Uh ... if you don't want to use the Windows API, what do you want to use? – Harry Johnston Apr 24 '14 at 01:20
  • I want to write a code that is cross platform. Basically I have a database and I need to read the $BITMAP file from it. I have parsed MFT by reading boot sector, but now I want to know the block/cluster no. of $BITMAP file to read it. – user3395981 Apr 25 '14 at 06:27

1 Answers1

0

I have solved my issue by parsing the MFT. I have referred this post from CodeProject. I have read/parsed MFT_IDX_BITMAP file and then read the $DATA attribute.

user3395981
  • 41
  • 5