starting sector No. of a file on NTFS

[zulfiqar Abbas]

Please, some one help me to find out the starting and ending sector no. of any specific file on NTFS.

I am using C language.

[Paul Komski]

It's particularly not straight forward under NTFS since part (sometimes all for small files) of the file is in the $MFT (master file table) and other parts are "mapped-out" to various parts of the drive. In that sense very few files are ever truly contiguous under NTFS.

WinHex will extract the various bits and present them in hex as a single file so that you can edit any part of the file from its first to its last sector if that is what is wanted. If you want to find the accumulated bits where they lie on the platters then that gets more complicated.

[zulfiqar Abbas]

Thanks for your answer. Actually I need to know the location of a specific file, only Hardisk starting sector No. will be enough for me. I need to use it in a program written in C language.

[Paul Komski]

Try WinHex from www.x-ways.net.

First ensure that from the [View >> Show] submenu that both the "Directory Browser" and the "Cluster List" boxes are checked. Then from the [Tools >> Open Disk] submenu ensure that you select the partition as a logical drive and don't choose the physical media.

Browse through the DirectoryBrowser to find the file or folder you want (and bear in mind that on an NTFS partition that folders are actually also files; everything under NTFS is a file and it is the attributes that then define that file).

As you select each file the values in the ClusterList will change to match the selected item and should show the ($mft) entry position in the mft if the file is self-contained or a list of clusters if the file is mapped-out and with a suffix of how many fragments the file has. As you select each item the Main Hex Display will jump to the offset that matches the starting position of the file on the partition in question. The first offset now shown in the hex display will be the starting sector of the file. It may show in decimal or in hex and these values are toggled by clicking anywhere in the Offset column. The starting sector will show at the very bottom as Sector XXX of yyy and if you move the cursor in the hex this sector value will change as you move from sector to sector. Presumably that is the value you want.

Whole files can be "reassembled" into hex in their own window by double-clicking on the file in the DirectoryBrowser.

Whole files can also be "reassembled" manually with the information obtained about the file's size, the ClulsterList and the starting sector.

If your program is expecting a FAT file system then I doubt if it will work the same way as with an NTFS partition; particularly for a self-contained attribute or for a fragmented file.

PS Also be warned that for ($mft) self-contained entries that the starting offset for the file will NOT be the start of the first relevant sector - the file's data will only begin further into the sector. This is perhaps easiest seen by comparing the data in a file reassembled by WinHex in its own window with the hex shown in the main window.

For ($mft) entries the starting and ending sectors are LIKELY to be the same.

As for the ending sector. This will be somewhere in the last cluster from the cluster list so you will need to convert clusters to sectors (depending on how many sectors per cluster your partition has) and calculate where the file ends in that last cluster since its cluster tip (unused part of cluster) will be a variable dependent on the size of the file.

Good luck - hope you get it to do what you want.