mrthaggar wrote:
Essentially what I'm trying to do is to to be able to determine the exact start and end offset of the file on the disk, e.g it runs from cluster x to cluster 512822, however I'm not sure if the sparse clusters are actually allocated directly before the second cluster run, making it one contiguous block, of if they could actually be allocated anywhere.
Sparse clusters don't exist, so they are not allocated anywhere. That's what sparse means: only those parts of the file that are stated to contain data (or that have been written to, regardless of value) are associated with physical clusters.
File sparseness is set by a call to DeviceIoControl (FSCTL_SET_SPARSE), and two file offsets: the byte offset in the file where the sparse part starts, followed by the byte length of it. You can do this multiple times for the same file.
You can retrieve these by a related call (FSCTL_QUERY_ALLOCATED_RANGES), so the information is fairly certain to be stored somewhere close to the file itself.
It's actually a bit more complex than that, but unless you intend to write your own code, that won't matter.
↧