ボリュームデータにアクセスするためにこのクラスを作成します。
class GetFiles
{
public void getlist()
{
NTFS_VOLUME_DATA_BUFFER volumData=new NTFS_VOLUME_DATA_BUFFER();
uint Resultsize=0;
IntPtr hroot = GetFiles.CreateFile(@"\\.\C:\", 0,
pinvok.FILE_SHARE_READ | pinvok.FILE_SHARE_WRITE,
IntPtr.Zero,
pinvok.OPEN_EXISTING,
pinvok.FILE_FLAG_BACKUP_SEMANTICS,
IntPtr.Zero);
GetFiles.DeviceIoControl(hroot,
pinvok.FSCTL_GET_NTFS_VOLUME_DATA,
IntPtr.Zero,0,
out volumData,(uint)Marshal.SizeOf(volumData),
out Resultsize,IntPtr.Zero
);
}
public struct pinvok
{
public const UInt32 FILE_SHARE_READ = 0x00000001;
public const UInt32 FILE_SHARE_WRITE = 0x00000002;
public const UInt32 FILE_ATTRIBUTE_DIRECTORY = 0x00000010;
public const UInt32 OPEN_EXISTING = 3;
public const UInt32 FILE_FLAG_BACKUP_SEMANTICS = 0x02000000;
public const Int32 INVALID_HANDLE_VALUE = -1;
public const UInt32 FSCTL_QUERY_USN_JOURNAL = 0x000900f4;
public const UInt32 FSCTL_ENUM_USN_DATA = 0x000900b3;
public const UInt32 FSCTL_CREATE_USN_JOURNAL = 0x000900e7;
public const UInt32 FSCTL_GET_NTFS_VOLUME_DATA = 0x00090064;
}
[StructLayout(LayoutKind.Auto,CharSet=CharSet.Unicode)]
public struct NTFS_VOLUME_DATA_BUFFER
{
public long VolumeSerialNumber;
public long NumberSectors;
public long TotalClusters;
public long FreeClusters;
public long TotalReserved;
public uint BytesPerSector;
public uint BytesPerCluster;
public uint BytesPerFileRecordSegment;
public uint ClustersPerFileRecordSegment;
public long MftValidDataLength;
public long MftStartLcn;
public long Mft2StartLcn;
public long MftZoneStart;
public long MftZoneEnd;
}
[DllImport("kernel32.dll", SetLastError = true)]
public static extern IntPtr CreateFile(string lpFileName, uint dwDesiredAccess,
uint dwShareMode, IntPtr lpSecurityAttributes,
uint dwCreationDisposition, uint dwFlagsAndAttributes,
IntPtr hTemplateFile);
[DllImport("kernel32.dll", ExactSpelling = true, SetLastError = true, CharSet = CharSet.Auto)]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool DeviceIoControl(IntPtr hDevice,
uint dwIoControlCode, IntPtr lpInBuffer, uint nInBufferSize,
out NTFS_VOLUME_DATA_BUFFER lpOutBuffer, uint nOutBufferSize,
out uint lpBytesReturned, IntPtr lpOverlapped);
}
例外が発生しました:
Type 'AccessMFT.GetFiles+NTFS_VOLUME_DATA_BUFFER' cannot be marshaled as an unmanaged structure; no meaningful size or offset can be computed.