Home All Groups Group Topic Archive Search About
Author
7 Aug 2006 11:13 PM
minoad
I am trying to work on some forensic software.  This requires that I
open the MFT directly from the hard disk.  Using vb.net, is thier a way
to read the file system by using sector ofsets?  I have been told that
this cannot be done using VB, however I am rarely confident in answeres
that tell me that i cannot do something.

Author
8 Aug 2006 6:37 PM
Chris Dunaway
minoad wrote:
> I am trying to work on some forensic software.  This requires that I
> open the MFT directly from the hard disk.  Using vb.net, is thier a way
> to read the file system by using sector ofsets?  I have been told that
> this cannot be done using VB, however I am rarely confident in answeres
> that tell me that i cannot do something.

Although I haven't looked through the System.IO namespace to confirm, I
don't think there are any classes there that will do what you want.

You will probably have to P/Invoke the DeviceIoControl function.

See this link for additional information:

http://www.pinvoke.net/default.aspx/kernel32/DeviceIoControl.html