5

In my C# application, I already have a way to examine the file system but I would like to take advantage of reading from the Master File Table (MFT) because it is so much faster. I understand that 1) it is a proprietary specification and therefore subject to change without notice, and 2) it is only accessible when the application is running under administrative privileges.

I managed to read the Master File Table via this code. From the MFT query, I get a file name and a so-called file reference number. What I can't find is how to transition to a .NET FileInfo object, or even to a Windows API file handle, so that I can get more information about the files/folders in question, like: file size, full path, date stamps, etc.

4

1 回答 1

4

当您潜伏在 MFT 中时，您可以采用两种直接的方法来打开文件 - 您可以使用该文件参考号（Vista 和更高版本）调用OpenFileByID，或者您可以通过遍历您的列表来构建完全限定的文件名在读取 MFT 然后使用组合名称调用CreateFile时构建。

您想从 CreateFile 或 OpenFileByID 获取句柄到 SafeFileHandle：

[DllImport( "kernel32.dll", SetLastError = true, CharSet = CharSet.Unicode )]
internal static extern SafeFileHandle CreateFile( string lpFileName, EFileAccess dwDesiredAccess, uint dwShareMode, IntPtr lpSecurityAttributes, uint dwCreationDisposition, uint dwFlagsAndAttributes, IntPtr hTemplateFile );

[DllImport( "kernel32.dll", SetLastError = true )]
internal static extern SafeFileHandle OpenFileById( IntPtr volumeHandle, ref FileIdDescriptor lpFileId, uint dwDesiredAccess, uint dwShareMode, uint lpSecurityAttributes, uint dwFlagsAndAttributes );

一旦你有了 SafeFileHandle（并且你检查了它是否有效），你可以将它传递给 FileStream 构造函数并像往常一样读/写文件。

每个文件都在 MFT 中表示，但有一些警告。例如，单个文件可以在多个位置的文件层次结构中，但所有它们都有一个 MFT 条目 - 这些是所谓的硬链接（它们不是副本 - 有多个入口点一个文件 - 头痛比比皆是）。有成千上万个。有用于询问硬链接的 API，但它变得丑陋。

于 2015-04-11T14:09:35.677 回答