1

I need some clarification on finding the last cluster of a file. Here are some code snippets on to how I got cluster info.

hFile = CreateFile(result,                          
        GENERIC_READ | GENERIC_WRITE,   
        FILE_SHARE_READ | FILE_SHARE_WRITE,
        NULL,                           
        OPEN_EXISTING,                  
        FILE_ATTRIBUTE_NORMAL,          
        NULL);          

while (error == ERROR_MORE_DATA){

    DWORD bytesReturned;

    returns = DeviceIoControl(hfile.hanFile,
        FSCTL_GET_RETRIEVAL_POINTERS,
        &startVcn,
        sizeof(startVcn),
        &output,
        sizeof(output),
        &bytesReturned,
        NULL);
    error = GetLastError();
    DWORD lastExtentN = retrievalBuffer->ExtentCount - 1;
LONGLONG lastExtent = retrievalBuffer->Extents[lastExtentN].Lcn.QuadPart;
LONGLONG lengthOfCluster = retrievalBuffer->Extents[lastExtentN].NextVcn.QuadPart - retrievalBuffer->Extents[lastExtentN - 1].NextVcn.QuadPart;         

switch (error){

    case ERROR_HANDLE_EOF:
        //file sizes 0-1kb will return EOF error 
        cout << "ERROR_HANDLE_EOF" << endl;
        returns = true;
        break;

    case ERROR_MORE_DATA:
        cout << "ERROR_MORE_DATA" << endl;
        startVcn.StartingVcn = retrievalBuffer->Extents[0].NextVcn; 

        case NO_ERROR:

    cout << "NO_ERROR, here is some info: " << endl 
    cout << "This is the lcnextent : "<<retrievalBuffer->Extents[lastExtentN].Lcn.QuadPart << endl;
    cout << "This is the nextvnc: " << retrievalBuffer->Extents[lastExtentN].NextVcn.QuadPart << endl;
    cout << "This is the Extent count: " << retrievalBuffer->ExtentCount << endl;
    cout << "This is the Starting Vnc" << retrievalBuffer->StartingVcn.QuadPart << endl;
    cout << " The length of the cluster is: " << lengthOfCluster << endl;
    cout << " The last cluster is: " << lastExtent + lengthOfCluster - 1 << endl << endl << endl;
            break;

        default:
            cout << "Error in the code or input error" << endl;
            break;
        }
}

I'm not sure if I found the correct cluster. To find the last cluster, I first found the size of the last cluster Extents[lastExtentN].NextVcn.QuadPart - Extents[lastExtentN - 1].NextVcn.QuadPart then I found the location with Extents[lastExtentN].Lcn.QuadPart + lengthOfCluster - 1 . In my output for example I get: 

This is the lcnextent : 76638
This is the nextvnc: 285
This is the Extent count: 3
This is the Starting Vnc 0
The length of the cluster is: 1
The last cluster is: 76638

Does my code and output make sense? Are the outputed numbers in bytes?

Lukkha Coder
  • 4,421
  • 29
  • 25
dspaces1
  • 193
  • 1
  • 3
  • 15
  • None of the numbers are in bytes - they are cluster addresses and cluster counts. Your `lengthOfCluster` variable is mis-named - it should be something like `lengthOfExtent`. – nobody Jun 09 '14 at 19:34
  • Gotcha. So if the information is valid then I could Createfile() the volume the file is located in and then use ReadFile() to read off the last cluster? – dspaces1 Jun 09 '14 at 19:41
  • 1
    Basically, yes. You'll need to get the volume cluster size first so that you can multiple cluster numbers by cluster size to get byte addresses withing the volume. – nobody Jun 09 '14 at 20:14
  • Would you happen to know how or what function can find out what volume a given file is in? – dspaces1 Jun 09 '14 at 20:29

0 Answers0