How to obtain the space used by NTFS volumes

Original article. Please indicate the source for reprinting. Thank you!
Author: Qinglin, blog name: feikong jingdu

 

The space used by the NTFS Volume here is simply the space used by the NTFS partition. If some people see this, they say: this is too simple, you can directly use the getdiskfreespace or getdiskfreespaceex API. But here, from the perspective of the file system, I simply do not rely on the API to directly calculate the space used by the NTFS partition, if you only want to use one API, you do not need to read it.

 

The space used to obtain the NTFS Volume is actually the size of all the files in the NTFS Volume, including the metadata files in the NTFS.

 

One way is to read the $ bitmap file, and then directly read the location of the $ bitmap file to calculate the size of the space used for the entire volume, but if you do this directly, the size of the space used is inaccurate, because the size of the Space identified by $ bitmap is not necessarily consistent with the size of the entire volume, in fact, the size of $ bitmap is usually larger than the size of the entire volume. Therefore, we need to intercept this $ bitmap, the truncation method is to read the BPB parameter in the partition to obtain the size of the entire volume, and then use this size to intercept $ bitmap. the size indicated by $ bitmap is consistent with the size of the entire volume, in this way, the space used by the calculated volume is close.

 

The following describes the 2nd methods. This method is the most accurate method for obtaining the space used by the volume.

I don't want to use the text here, but I want to use a piece of pseudocode to describe it. I think it will be clearer.

 

...... <Br/> dwltotalused = 0; <br/> unsigned long I; <br/> // traverses every record file in the MFT table, dwlmftcount is the number of records in MFT <br/> for (I = 0; I <dwlmftcount; ++ I) <br/>{< br/> for (each attribute in the traversal record) <br/>{< br/> If (the attribute is not a resident attribute) <br/> dwltotalused + = data size of a very resident attribute; <br/>}< br/> ......

 

This is just a simple algorithm. If you want to implement it, you need to process deleted files, compressed files, encrypted files, and so on.

 

In this way, the space used to obtain NTFS volumes is the most accurate, and it is also the way for Linux ntfs-3g to get partitions using space size.