advntfs.bas

Project to Read Hard Disk data (raw format) at Windows Run Time

Attribute VB_Name = "AdvNtfs"
Option Explicit

Public Declare Function DeviceIoControl Lib "kernel32" (ByVal hDevice As Long, ByVal dwIoControlCode As Long, _
lpInBuffer As Any, ByVal nInBufferSize As Long, lpOutBuffer As Any, ByVal nOutBufferSize As Long, lpBytesReturned As Long, _
lpOverlapped As Any) As Long
'------------------------------------------------------------------------------------------------------------------------
Public Const KB = 1024&
Public Const MB = KB * KB
Public Const GB = MB * KB
Public Type LARGE_INTEGER
    lowpart As Long
    highpart As Long
End Type


Public Const IOCTL_DISK_GET_DRIVE_LAYOUT As Long = &H7400C
'---------------------------------------------------
Public Type PARTITION_INFORMATION
StartingOffset As LARGE_INTEGER
PartitionLength As LARGE_INTEGER
HiddenSectors As Long
PartitionNumber As Long
PartitionType As Byte
BootIndicator As Boolean
RecognizedPartition As Boolean
RewritePartition As Boolean
End Type

Public vax As PARTITION_INFORMATION
'---------------------------------------------
Public Type DRIVE_LAYOUT_INFORMATION
  PartitionCount As Long
  Signature As Long
  PartitionEntry(32) As PARTITION_INFORMATION 'mem adress
End Type
'------------------------------------------------------
Public dli As DRIVE_LAYOUT_INFORMATION
'===============================================================

Public Const FSCTL_GET_NTFS_VOLUME_DATA As Long = &H90064
'-----------------------------------------------------------------------------------------
Public Type NTFS_VOLUME_DATA_BUFFER
VolumeSerialNumber As LARGE_INTEGER
NumberSectors As LARGE_INTEGER
TotalClusters As LARGE_INTEGER
FreeClusters As LARGE_INTEGER
TotalReserved As LARGE_INTEGER
BytesPerSector As Long
BytesPerCluster As Long
BytesPerFileRecordSegment As Long
ClustersPerFileRecordSegment As Long
MftValidDataLength As LARGE_INTEGER
MftStartLcn As LARGE_INTEGER
Mft2StartLcn As LARGE_INTEGER
MftZoneStart As LARGE_INTEGER
MftZoneEnd As LARGE_INTEGER
End Type
'-------------------------------------------------------------------------
Public ntfsv As NTFS_VOLUME_DATA_BUFFER
'===============================================================



Public Function getNTFSData()
Dim ret&, bret&
ret = DeviceIoControl(drvHandle, FSCTL_GET_NTFS_VOLUME_DATA, ByVal 0&, 0&, ByVal ntfsv, Len(ntfsv), bret, ByVal 0)
 With ntfsv
Debug.Print "Volume serial Hi " & Hex(.VolumeSerialNumber.highpart) & " Lo " & Hex(.VolumeSerialNumber.lowpart)
Debug.Print "Sec Hi " & .NumberSectors.highpart & " Lo " & .NumberSectors.lowpart
Debug.Print "TCl Hi " & .TotalClusters.highpart & " Lo " & .TotalClusters.lowpart
Debug.Print "FCl Hi " & .FreeClusters.highpart & " Lo " & .FreeClusters.lowpart
Debug.Print "Tres Hi " & .TotalReserved.highpart & " Lo " & .TotalReserved.lowpart
Debug.Print "BPs Hi" & .BytesPerSector & " Bpc " & .BytesPerCluster
Debug.Print "BpFileRecSeg " & .BytesPerFileRecordSegment & " CluspFileRecSeg " & .ClustersPerFileRecordSegment
Debug.Print "MFT Valid Data Lenght Hi " & .MftValidDataLength.highpart & " Lo " & .MftValidDataLength.lowpart
Debug.Print "MFT StartLcn Hi " & .MftStartLcn.highpart & " Lo " & .MftStartLcn.lowpart
Debug.Print "MFT2 StartLcn Hi " & .Mft2StartLcn.highpart & " Lo " & .Mft2StartLcn.lowpart
Debug.Print "MFT StartZone Hi " & .MftZoneStart.highpart & " Lo " & .MftZoneStart.lowpart
Debug.Print "MFT EndZone Hi " & .MftZoneEnd.highpart & " Lo " & .MftZoneEnd.lowpart
End With
 
End Function
Public Sub getpart()
Dim a As Object, b As Object, c As Object
 Set a = GetObject("winmgmts:{ImpersonationLevel=Impersonate}\root\cimv2").InstancesOf("Win32_DiskPartition")
 
 For Each b In a
       Debug.Print "Partition #" & b.Index & " StartOffset " & CDbl(b.StartingOffset / 512&) & " Lenght " & Format(CDbl(b.Size / GB), "0.00 \G\B") & " Hs " & b.HiddenSectors
 Next
 
 Set a = Nothing
 Set b = Nothing
End Sub

Public Function getpartb() As String
Dim ret&, bret&

ret& = DeviceIoControl(drvHandle, IOCTL_DISK_GET_DRIVE_LAYOUT, ByVal 0&, 0&, ByVal VarPtr(dli), Len(dli), bret, ByVal 0)
With dli
For ret = 0 To dli.PartitionCount - 1
DoEvents
With dli.PartitionEntry(ret)
If .PartitionLength.lowpart <> 0 And .PartitionNumber <> 0 Then
        Debug.Print "PN #" & .PartitionNumber & " Offset " & (.StartingOffset.highpart * (2 ^ 32) + .StartingOffset.lowpart) / 512 & " Plen " & Format(CDbl((.PartitionLength.highpart * (2 ^ 32) + .PartitionLength.lowpart) / GB), "0.00 \G\B") & "  Pt " & .PartitionType
End If

End With

Next
End With

End Function