Obtaining File System Recognition Information Example
File system recognition is the ability to recognize storage media that contain a valid file system/volume layout that hasn’t been defined yet, but the media is able to identify itself through the presence of the recognition structure defined internally by Windows. Because no existing file system will recognize a new disk layout, the RAW file system will mount the volume and provide direct block level access. The RAW file system, incorporated in ntoskrnl, will have the ability to read the file system recognition structure and provide applications access to such structures through the file system control request FSCTL_QUERY_FILE_SYSTEM_RECOGNITION, shown in the following code snippet.
Create a new Win32 console application project and give a suitable project name.
Add the source file and give a suitable name.
Add the following source code.
#include <windows.h>
#include <stdio.h>
#include <wchar.h>
// Min client - Windows 7;
// Min server - Windows Server 2008 R2
#include <Winioctl.h>
typedef struct _FILE_SYSTEM_RECOGNITION_INFORMATION {
CHAR FileSystem[9];
}FILE_SYSTEM_RECOGNITION_INFORMATION, *PFILE_SYSTEM_RECOGNITION_INFORMATION;
STDMETHODIMP Check(PCWSTR pcwszDrive)
{
HRESULT hr = S_OK;
HANDLE hDisk = INVALID_HANDLE_VALUE;
FILE_SYSTEM_RECOGNITION_INFORMATION FsRi = {0};
DWORD dwIoControlCode = 0;
BOOL fResult = FALSE;
ULONG BytesReturned = 0;
// Open the target, for example \\.\F:
wprintf(LCreateFile() on %s...\n, pcwszDrive);
hDisk = CreateFile(pcwszDrive,
FILE_READ_ATTRIBUTES|SYNCHRONIZE|FILE_TRAVERSE,
FILE_SHARE_READ|FILE_SHARE_WRITE,
NULL, OPEN_EXISTING, 0, NULL);
if(hDisk == INVALID_HANDLE_VALUE)
{
hr = GetLastError();
wprintf(LCreateFile() failed on %s, error = %u\n, pcwszDrive, GetLastError());
exit(1);
}
wprintf(LCreateFile() succeeded.\n);
wprintf(L\nPress Any Key to send down the FSCTL...\n);
_getwch();
// Send down the FSCTL
wprintf( LCalling DeviceIoControl(...,FSCTL_QUERY_FILE_SYSTEM_RECOGNITION,...)\n );
// https://msdn.microsoft.com/en-us/library/aa365729%28VS.85%29.aspx
// and another one: https://msdn.microsoft.com/en-us/library/cc232013%28PROT.10%29.aspx
fResult = DeviceIoControl(hDisk, FSCTL_QUERY_FILE_SYSTEM_RECOGNITION, NULL, 0,
&FsRi, sizeof(FsRi), &BytesReturned, NULL );
if(!fResult)
{
hr = HRESULT_FROM_WIN32(GetLastError());
wprintf(LDeviceIoControl() failed, error %u\n, GetLastError());
exit(1);
}
wprintf(LDeviceIoControl() succeeded.\n);
wprintf(LFSCTL_QUERY_FILE_SYSTEM_RECOGNITION returned success.\n);
wprintf(LFSCTL_QUERY_FILE_SYSTEM_RECOGNITION thinks the filesystem is \%s\.\n, FsRi.FileSystem);
if(hDisk != INVALID_HANDLE_VALUE)
{
CloseHandle(hDisk);
hDisk = INVALID_HANDLE_VALUE;
}
return hr;
}
int wmain(int argc, WCHAR **argv)
{
Check(L\\\\.\\C:);
return 0;
}
Take note that the FSCTL_QUERY_FILE_SYSTEM_RECOGNITION cannot be found in the Winioctl.h header file at the moment this program example was tested. It is intended for vendors and the minimum system to run this program is Windows 7/Server 2008 R2.