last day (16 days later) » 

9:10 PM
-1
Q: Enumerate all partitions and test if they are NTFS

BasjI'm using: DWORD d = GetLogicalDrives(); for (int i = 0; i < 26; i++) { if ((1 << i) & d) // drive letter 'A' + i present on computer { wstring s = std::wstring(L"\\\\.\\") + wchar_t('A' + i) + L":"; PARTITION_INFORMATION diskInfo; DWORD dwResult; HANDLE ...

 
You are not doing any error handling. You are not checking to make sure that CreateFile() and DeviceIoControl() are actually successful before evaluating diskInfo.PartitionType. Another way to find NTFS partitions is to use GetLogicalDrives/Strings() and GetVolumeInformation(), the lpFileSystemNameBuffer parameter will return the name of the file system on each drive you query...
... At the very least, you should use GetLogicalDrives/Strings() anyway. This will reduce the number of drives you attempt to query, even if you stick with CreateFile()/DeviceIoControl(). Instead of blindly trying all 26 letters of the alphabet, you only have to query the ones that have actually been assigned to a drive.
 
@RemyLebeau In fact in my original code, I did use GetLogicalDrives, I didn't include it here because I thought it was not relevant for the problem, but you're right: it's an important part, so I edited the question to include it. (Sorry, I should have included it before). With the current code, what would you change? If you have the possibility, could you post a sample code in an answer? Thank you in advance.
@RbMm If possible, could you post a full code sample? Because I see many different techniques: GetLogicalDrives, DeviceIoControl, IOCTL_DISK_GET_PARTITION_INFO vs. IOCTL_DISK_GET_PARTITION_INFO_EX, Get-WMiObject, GetVolumeInformationW, etc. so we could easily get confused. A good answer would be very helpful for people who want to enumerate NTFS volumes in the future.
@RemyLebeau Or maybe you have a sample code (see previous comment)?
 
@Basj many different ways to tackle this. So try them all and see which one works best for your situation and skillset.
 
@RemyLebeau I just inspected the return values. For ret = DeviceIoControl(dev, IOCTL_DISK_GET_PARTITION_INFO, NULL, 0, &diskInfo, sizeof(diskInfo), &lpBytesReturned, NULL);, on the computer where it failed, I once got 0 0 for lpBytesReturned and ret. After reboot, I had 2005860068 0. In both cases, 0 for ret indicates a failure. Any idea how I can investigate further?
 
@Basj You need to check the return value of CreateFile() before calling DeviceIoControl(). CreateFile() returns INVALID_HANDLE_VALUE on failure. Also, you need to use GetLastError() to find out WHY each of these functions is failing. For example: dev = CreateFile(...); if (dev == INVALID_HANDLE_VALUE) { DWORD err = GetLastError(); ... } else { ret = DeviceIoControl(dev, ...); if (ret == FALSE) { DWORD err = GetLastError(); ... } CloseHandle(dev); }
 
9:10 PM
@RemyLebeau Thank you. I followed your advice, and investigation shows that CreateFile succeeds, and DeviceIoControl fails (returns 0 / FALSE). GetLastError() is 1. I looked here but I don't find the reason for the error.
@RbMm I also looked at using IOCTL_DISK_GET_PARTITION_INFO_EX instead of IOCTL_DISK_GET_PARTITION_INFO but then the structure PARTITION_INFORMATION_EX does not seem to give informations about PartitionType, whereas the structure PARTITION_INFORMATION does give access to PartitionType.What do you think?
@RemyLebeau If you have a few minutes, do you think it's possible to chat (not very long). I spend the whole day on this, but I can't find the error ;) (see my previous message about GetLastError).
 
@Basj per System Error Codes (0-499), error code 1 is ERROR_INVALID_FUNCTION. That means IOCTL_DISK_GET_PARTITION_INFO is not supported by the device you passed to DeviceIoControl().
@Basj "PARTITION_INFORMATION_EX does not seem to give informations about PartitionType" - yes, it does. PARTITION_INFORMATION_EX has a PartitionStyle field that tells you whether to look at the Mbr or Gpt field for more information. Both of those structs have a PartitionType field. Mbr.PartitionType is a BYTE, Gpt.PartitionType is a GUID.
 
Thank you @RemyLebeau.
Indeed on the computer where the previous code fails, the *_EX version works!
and surprise, the PartitionStyle (docs.microsoft.com/en-us/windows/desktop/api/winioctl/…) is GPT indeed.
Now last thing: PartitionType can take these values: docs.microsoft.com/en-us/windows/desktop/api/winioctl/… in the PARTITION_STYLE_GPT case. But how to recognize a NTFS partition there?
When it's PARTITION_STYLE_MBR, it's easy: diskInfo.Mbr.PartitionType is 0x07 for PARTITION_IFS: see docs.microsoft.com/en-us/windows/desktop/FileIO/…
But when it's PARTITION_STYLE_GPT, I don't see how to test if it's NTFS or not...
Sorry for all these messages @RemyLebeau
 
9:40 PM
@Basj IOCTL_DISK_GET_PARTITION_INFO is not supported on GPT partitioned drives. In any case, a partition type and a FileSystem type are two different things. Though an MBR partition MAY correlate a partition type to a particular filesystem, you should not rely on that (indeed, partition type 0x07 (IFS) can mean different things in different contexts, where NTFS is just one possibility).
@Basj You would have to read into the actual partition data to determine the type of filesystem used inside the partition. GetVolumeInformation() would be easier for this task instead.
 
Ok thank you!
@RemyLebeau To give you the big picture, I'm doing an indexing software that uses DeviceIoControl(hVol, FSCTL_ENUM_USN_DATA, ...). It works super great, but I just need to make sure that the volume supports it.
@RemyLebeau To do that, I first wanted to iterate over all disk letters and check if they are NTFS (then I can build database with DeviceIoControl(hVol, FSCTL_ENUM_USN_DATA, ...)). If they are not, I skip the volume.
Given this goal, what check would you do?
* just GetVolumeInformationW and check it's "NTFS"?
 
@Basj Why not just skip the filesystem check altogether, and instead just attempt FSCTL_ENUM_USN_DATA unconditionally and skip the volume if any error is reported? You should be able to differentiate an "unsupported" error from other kinds of errors.
 
Maybe I should just do that...
You're saving me a day of unsuccessful attempts :)
what's the worst that can happen if it tries to FSCTL_ENUM_USN_DATA a drive for which it should not be done (example : FAT32)
 
@Basj It will simply return an ERROR_INVALID_FUNCTION error, per the documentation: "ERROR_INVALID_FUNCTION The file system on the specified volume does not support this control code."
 
Maybe I'll try that...
Thanks one million times @RemyLebeau!
I'll maybe post a bounty soon because this question (properly enumerating the NTFS volumes) is interesting independently of this nice solution you gave.
I think it would save hours to other users too in the future :)
 
10:05 PM
for enumerate volumes call CM_Get_Device_Interface_ListW with GUID_DEVINTERFACE_VOLUME and may be GUID_DEVINTERFACE_HIDDEN_VOLUME (but this is faster of all have Raw filesystem). for get filesystem name call GetVolumeInformationW for example on returned volume name
 
 
2 hours later…
11:43 PM
@RbMm Find(First|Next)Volume() would be easier, and they are available to Win32 apps whereas CM_Get_Device_Interface_ListW() is for Universal apps instead.
 

  last day (16 days later) »