Logical Drive Name

[Monty]

i opend the harddisk like this

sHardDisk.Format("\\\\.\\PhysicalDrive1");

HANDLE hDevice =
CreateFile(sHardDisk,GENERIC_READ,......,0,OPEN_EXISTING,0,0);


then i read the Partition table using ReadFile
Everything is fine i can read all the partitions and extended
partitions directly from harddisk but my questions is

How can i find out the logical drive name corresponding to the
Partitions and extended
partitions that i read directly from hard disk?

Thank you in advance.

 

[Marc Kupper]

i opend the harddisk like this

sHardDisk.Format("\\\\.\\PhysicalDrive1");
<snip>
How can i find out the logical drive name corresponding to the
Partitions and extended
partitions that i read directly from hard disk?

The main challenge is that a drive letter can span multiple
physical disks and that a single physical disk can contain two or
more volumes.

Take a look at GetLogicalDriveStrings() and QueryDosDevice() to
get the volume names. Use IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS
to translate from the volume names into physical device device
numbers. Insert "\\.\PhysicalDrive" in front of the numbers to
read from that physical disk.

Marc

 

[Monty]

Thank you for such a prompt and accurate reply

i wanted to read the MFT of individual drives, i had some sample code
that does it without logical drive names but now it seems the correct
way is to iterate all the drive names through GetLogicalDriveNames and
the read through QueryDosDevice and read the MFT

but i don't know how to read the MFT using QueryDosDevice and then
CreateFile
can you guide me or point me to some material that would provide more
detailed info

Thank you so much for your precious time

 

[Monty]

Also is there any other way except the use of
IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS
thanks

 

[Marc Kupper]

i wanted to read the MFT of individual drives, i had some
sample code that does it without logical drive names but now it
seems the correct way is to iterate all the drive names through
GetLogicalDriveNames and the read through QueryDosDevice and
read the MFT

That depends on what you want to do. If you know you want to
read the MFT for C: then use QueryDosDevice() to translate "C:"
into a logical volume name. (no iteration is needed). Once you
have the logical volume name you open it with CreateFile() and
then pass the handle to DeviceIoControl() with
IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS to get the list of physical
device numbers. You can then convert the physical device numbers
into physical device names and your existing sample code should
work for reading the MFT if there's just one physical device and
I have no idea if your code supports spanned volumes.

I'd just write the code and show you but don't have time at the moment.

Also is there any other way except the use of
IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS

I don't know off hand but Google for
IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS registry
seems to find interesting stuff and a quick look with regedit finds
HKEY_LOCAL_MACHINE \ SYSTEM \ MountedDevices
Those look like Unicode strings and I suspect you can bypass at
least the call to QueryDosDevice() with this.

Marc