Scan disk unallocated space using .Net framework

Question

I want to play around with file recovery programming in dotNet (C#). The trouble is I dont know where to start. It seems like everything in dotNet assumes some kind of filesystem, directory and/or file already exists and Im interested in files that, according to the OS dont exist.

I assume I would have to learn something more about file formats, start and end markers and scan disk space for byte codes etc (0xFF, 0xD8 in jpegs for instance) but before I even get to that I wonder how to scan a disk sector by sector, including unallocated space for such byte codes in dotNet.

[This question](http://stackoverflow.com/q/1399485/62576) might help. — Ken White, Apr 08 '13 at 23:50
The answer to this question might get you started: http://stackoverflow.com/questions/3533219/how-do-i-access-a-raw-sector-of-disk-in-xp-with-a-c-program - I'm (wildly) guessing you'll simply have to use the Windows API, which isn't exactly .NET. This also means you'll have better luck searching for how to do raw disk access in general, not just .NET — millimoose, Apr 08 '13 at 23:50

Serdalis · Answer 1 · 2013-04-09T00:18:41.967

I have a little program floating around that will read the disk by chunks, this will help you, but it is in C++ using windows API and not .net.

Store internal HDD Information:

typedef struct DRIVE {
    HANDLE hDrive;
    int sector;
    int *sector_data;
    DWORD dwRead;
    int sector_size;
} drive;

Open for reading:

/*-- Create Structure to store drive data --*/
DRIVE CDRIVE;
/*-- Open the C drive as a file --*/
CDRIVE.hDrive = CreateFile("\\\\.\\C:", GENERIC_READ, (FILE_SHARE_READ | FILE_SHARE_WRITE), NULL, OPEN_EXISTING, NULL, NULL);
/*-- Set Initial Data in Drive Structure --*/
CDRIVE.sector = 0;
CDRIVE.sector_size = WHATEVER_YOU_CHOOSE;
CDRIVE.sector_data = new int[WHATEVER_YOU_CHOOSE];

if(CDRIVE.hDrive == INVALID_HANDLE_VALUE) {
    return false;
}

Reading:

/*-- Set the position of the reading pointer --*/
SetFilePointer(CDRIVE.hDrive, CDRIVE.sector*CDRIVE.sector_size, 0, FILE_BEGIN);
/*-- empty the previous sector data (to be honest this is only a precaution) --*/
memset(CDRIVE.sector_data, 0, sizeof(CDRIVE.sector_data));
/*-- Read the new data --*/
ReadFile(CDRIVE.hDrive, CDRIVE.sector_data, CDRIVE.sector_size, &CDRIVE.dwRead, 0);

Hope this is useful to you!

Scan disk unallocated space using .Net framework

1 Answers1