I'm experiencing some issues while reading raw data from NTFS Volume.
I've opened my C: drive using UNC path ("\.\C") using CreateFile
in order to be able to read raw from it.
As I read the first sector, I discovered that I'm reading the MBR sector.
As far as I know, there is a distinction between Volumes (in this case, my C
drive), and physical drives (which are represented as \\.\PhysicalDriveX
).
The difference is that the MBR is only located at the first sector of the physical drive while the Volume represents a logical drive (one partition or more within the same hard drive) and therefore reading the first sector of it shouldn't be, theoretically, the MBR (because actual partition starts only after the partition table of the MBR).
What is more peculiar to me is while I'm expecting to get the MBR when reading the first sectore of \\.\PhysicalDrive0
(Which is my physical HDD), I get only NULLs.
According to wikipedia:
master boot record (MBR) is a special type of boot sector at the very beginning of partitioned computer mass storage devices like fixed disks or removable drives
Although I think it is pretty clear, I'm attaching the relevant code:
tNtfsVolumeContext.hVolume = CreateFile(_T("\\\\.\\C:"), GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_READONLY, NULL);
if (INVALID_HANDLE_VALUE == tNtfsVolumeContext.hVolume)
{
return -1;
}
if ((!ReadFile(tNtfsVolumeContext.hVolume, &tBootSector, NTFS_SECTOR_SIZE, &dwBytesRead, NULL)) || (dwBytesRead != NTFS_SECTOR_SIZE))
{
return -2;
}
I'll sum things up to my question, is there is a good explanation why reading a sector from a volume will result in reading the MBR while reading from a physical drive yields in nothing??
Thanks in advance.