lordmike/rawdisklib

A C# Library to read from raw sectors of a disk

RawDiskLib

A C# Library to read from raw sectors of a disk

rawdisklib's Issues

Windows 10 changes to NTFS cluster sizes

https://dfir.ru/2019/04/23/ntfs-large-clusters/

[Bug] Unable to create `RawDisk` from numbers returned

Windows 10 x64:
All 3 fixed disks give the above exception

Is RawDiskLib also working under Linux and also with ext4?

Hi Mike,

I was wondering if the RawDiskLib is also working under Linux with Mono and is also handling ext4 partitions?

Best
Mic

Bug: Array dimensions exceeded supported range

Hi,

I am running a Windows 8.1 system with 64GB RAM, 5 Samsung SSDs

When running TestApplication and activate the Examples one after the other, the first example works but the second example returns with "Exception message: Array dimensions exceeded supported range" . it seems to be an "System.OverflowException" in RawDiskLib.dll. Looking into Taskmanager the TestApplication consumes enormous amounts of RAM as soon as the second example is started.
This behavior is independent to which examples you run first. So you can skip the first an the second example, run the third, skip the fourth and run the fifth. In that case the fifth example runs into the OverflowException.
I tried building with Rider 2019.3.3 and Visual Studio 2017 Community. Tried .NET 4.0 and .NET 4.8. In all cases the problem is the same.

[Edit]: I tried to Debug with the Rider Debugger. When debugging and doing all step by step. Everything is fine. As soon as I resume the program at "example.Execute();" the memory issue happens.

Best
Mic

"System.UnauthorizedAccessException" in mscorlib.dll in ExampleWriteDrive

Hi Mike,
Another Problem. When accessing a Volume on my Computer with the "ExampleWriteDrive" it always gives me a "System.UnauthorizedAccessException" in mscorlib.dll in the line

disk.WriteClusters(chunkData, chunk * ExampleUtilities.ClustersToRead);

even if I am acting as Administrator. Is there any trick to write to it? It is online and mounted.

Best
Mic

RawDisk Resume Write

Hi Mike,
I ve written a c# application which writes a partition with your RawDisk Library and it works fine. It creates a partition and writes to it. Now I want to make my program recover from a kill by restarting and continue writing to the partition. For this my program writes the last written cluster to a file.
When restarting the program, it reads the cluster number from the file, opens the existing partition with RawDisk again, seeks the offset position of the found cluster and tries to continue writing.
But tgtDisk.WriteCluster() throws an exception "Access to the path is denied". There is no other process running accessing that partition.
Do you have any idea, what happens? It seams that this happens, when I try to open an existing partition.
Best
Mic

Looks like you're using ReSharper.

ReSharper (stylized R#) is a bad technology, for it requires you to pay a lot.

Here's evidence:

  1  #if NETCORE
> 2  // ReSharper disable once CheckNamespace
  3  namespace System.Diagnostics
  4  {
  5      internal static class Debug
  6      {
  7          public static void WriteLine(string message)
  8          {
  9              // Do nothing
  10         }
  11 
  12         public static void Assert(bool condition)
  13         {
  14             if (!condition)
  15                 throw new Exception("Assertion failure");
  16         }
  17     }
  18 }
  19 #endif

Volume shadow copy access via this project?

I plan to start playing with this a bit more but figured I would ask if you've already done this before I out some time Into it. I would imagine it would be some derivative of the "shadow copy volume" path that would so it.

Thank you for a great library

Strange behavior for $LogFile and $Boot when calling GetFileInfo

I am able to copy things, get file info, etc for most of the files i am interacting with. The $MFT works fine when asking for FileInfo and returns the proper timestamps, but for $LogFile and $Boot (both on C and the VSCs), it always returns 0 for the timestamps. strange the MFT works but not the other 2 in the root of the volume

Here is an example:

Copied deferred file 'c:$MFT' to 'C:\Temp\touttest\c$MFT' | Source SHA-1: C9D5F19E21515436CDD2F2FF1149934B01E831B6 | Source created: 2018-12-18 02:11:08.2193228 | Source modified: 2018-12-18 02:11:08.2193228 | Source last accessed: 2018-12-18 02:11:08.2193228

Copied deferred file 'c:$LogFile' to 'C:\Temp\touttest\c$LogFile' | Source SHA-1: 97B990D5553409AAE75D472C6D3B3B29E25AC20F | Source created: 1601-01-01 00:00:00.0000000 | Source modified: 1601-01-01 00:00:00.0000000 | Source last accessed: 1601-01-01 00:00:00.0000000

Copied deferred file 'c:$Extend$UsnJrnl:$J' to 'C:\Temp\touttest\c$Extend$J' | Source SHA-1: 02060A2936CCDAABEB188FF7B9A45BE79F608A00 | Source created: 2018-12-18 02:16:30.4603294 | Source modified: 2018-12-18 02:16:30.4603294 | Source last accessed: 2018-12-18 02:16:30.4603294

Copied deferred file 'c:$Extend$UsnJrnl:$Max' to 'C:\Temp\touttest\c$Extend$Max' | Source SHA-1: BD781FE13AEF606B933612E546D902CE1A9BCE08 | Source created: 2018-12-18 02:16:30.4603294 | Source modified: 2018-12-18 02:16:30.4603294 | Source last accessed: 2018-12-18 02:16:30.4603294

Copied deferred file 'c:$Secure:$SDS' to 'C:\Temp\touttest\c$Secure_$SDS' | Source SHA-1: 2B9E2DFE88D51352C5C934CD8C1640834994ABB5 | Source created: 2018-12-18 02:11:08.2193228 | Source modified: 2018-12-18 02:11:08.2193228 | Source last accessed: 2018-12-18 02:11:08.2193228

Copied deferred file 'c:$Boot' to 'C:\Temp\touttest\c$Boot' | Source SHA-1: 324407D1A388AB29FB1787BCBA2FE1A5F59B31ED | Source created: 1601-01-01 00:00:00.0000000 | Source modified: 1601-01-01 00:00:00.0000000 | Source last accessed: 1601-01-01 00:00:00.0000000

Copied deferred file 'c:$Extend$RmMetadata$TxfLog$Tops:$T' to 'C:\Temp\touttest\c$Extend$RmMetadata$TxfLog$T' | Source SHA-1: A36AF6320A05E10C0E9887E8D4999D3CF679E093 | Source created: 2018-12-18 02:11:08.3879795 | Source modified: 2018-12-18 02:11:08.3879795 | Source last accessed: 2018-12-18 02:11:08.3879795

X-ways is showing timestamps, so not sure why this is behaving this way.

any ideas? same code is doing the work for all of these

Open partition with RawDisk, which is no volume

Hi LordMike,

I was wondering if RawDisk() is able to also open a partition on disk which has no volume, i.e. a partition containing a fs which is not recognized by Windows.

Best
Rampftl

ExampleHashDrives

I've used the example HashDrives code for hashing complete drives, by setting the lengthTodo = disk.SizeBytes, but it fails against a Kingston 128GB USB drive when trying to access the last sector, with the error "The drive cannot find the sector requested".

The device can be successfully hashed using other tools without issue.

The drive has an odd number of sectors (242,155,521 sectors, 512 bytes per sector (123,983,626,752 bytes)). Could this be causing the problem?

Error Creating RawDiskStream on a macbook pro running bootcamp

We've been using your library in our project https://github.com/rough007/CyLR and it's been great! But we do have a user who is experiencing some issues and we were hoping you might have some insight.
Our tracking of the issue is here: orlikoski/CyLR#50

The relevant part of the call stack we're getting is here:
System.ArgumentOutOfRangeException: Non-negative number required.
Parameter name: length
at System.Array.Copy(Array sourceArray, Int32 sourceIndex, Array destinationArray, Int32 destinationIndex, Int32 length, Boolean reliable)
at System.Array.Copy(Array sourceArray, Int64 sourceIndex, Array destinationArray, Int64 destinationIndex, Int64 length)
at RawDiskLib.RawDiskStream.Read(Byte[] buffer, Int32 offset, Int32 count)

I don't know if this issue is related to bootcamp or not, other users running bootcamp have been able to run the utility fine.