Use the $ bitmap Metafile to calculate the space used by the NTFS partition

Original article. Please indicate the source for reprinting. Thank you!
Author: Qinglin, blog name: feikong jingdu

 

In my previous article, how to obtain the space used by NTFS volumes
This section describes how to obtain the partition space used by the NTFS file system in two ways. Here, I will use the first method to calculate the space used by the entire partition through the bitmap Metafile in NTFS.

 

In
Space used by NTFS Volume
The bitmap Meta File in NTFS is used to calculate the size of the space used by the entire partition. Because bitmap cannot fully represent the size of the entire partition, it is necessary to intercept the bitmap file, however, we can use bitmap to calculate the free space size and do not need to intercept bitmap files, because bitmap sets the bitbits that exceed the partition to 1, in this way, the partition will not use the space that exceeds the partition part, so that we can calculate the free space size and only calculate the 0 part.

 

Next, I will use a program to get the free space size of the NTFS partition, and compare this size with the free space size of the partition seen in the XP system.

First, we read the partition's DBR, where DBR is located in the first sector of the partition, so that we can get information about the partition, including the size of the entire partition. The DBR Structure is like this (the DBR Structure comes from the NTFS-3g code and has modifications ):

Typedef struct <br/>{< br/> word bytes_per_sector;/* size of a sector in bytes. */<br/> byte sectors_per_cluster;/* size of a cluster in sectors. */<br/> word reserved_sectors;/* zero */<br/> byte fats;/* zero */<br/> word root_entries; /* zero */<br/> word sectors;/* zero */<br/> byte media_type;/* 0xf8 = Hard Disk */<br/> word sectors_per_fat; /* zero */<br/>/* 0x0d */word sectors_per_track;/* required to Boot Windows. */<br/>/* 0x0f */word heads;/* required to Boot Windows. */<br/>/* 0x11 */DWORD hidden_sectors;/* offset to the start of the partition <br/> relative to the disk in sectors. <br/> required to Boot Windows. */<br/>/* 0x15 */DWORD large_sectors;/* zero */<br/>/* sizeof () = 25 (0x19) bytes */<br/>} bios_parameter_block; <br/> typedef struct <br/> {<br/> byte jump [3]; /* irrelevant (jump to boot up code ). */<br/> dwordlong oem_id;/* Magic "NTFS ". */<br/>/* 0x0b */bios_parameter_block BPB;/* See bios_parameter_block. */<br/> byte physical_drive;/* 0x00 floppy, 0x80 hard disk */<br/> byte current_head; /* zero */<br/> byte extended_boot_signature;/* 0x80 */<br/> byte reserved2; /* zero */<br/>/* 0x28 */dwordlong number_of_sectors;/* number of sectors in volume. gives <br/> maximum volume size of 2 ^ 63 sectors. <br/> assuming standard sector size of 512 <br/> bytes, the maximum byte size is <br/> approx. 4.7x10 ^ 21 bytes. (-; */<br/> dwordlong mft_lcn;/* cluster location of MFT data. */<br/> dwordlong mftmirr_lcn;/* cluster location of copy of MFT. */<br/> char clusters_per_mft_record;/* MFT record size in clusters. */<br/> byte reserved0 [3];/* zero */<br/> char clusters_per_index_record;/* index block size in clusters. */<br/> byte reserved1 [3];/* zero */<br/> dwordlong volume_serial_number;/* irrelevant (serial number ). */<br/> DWORD checksum;/* Boot Sector checksum. */<br/>/* 0x54 */byte Bootstrap [426];/* irrelevant (boot up code ). */<br/> word end_of_sector_marker;/* end of Boot Sector magic. always is <br/> 0xaa55 in little endian. */<br/>/* sizeof () = 512 (0x200) bytes */<br/>} ntfs_boot_sector;

 

In this way, we can know the MFT offset position (mft_lcn variable ).

In this way, we can read the 6th yuan file (the index starts from 0), that is, the $ bitmap file. We get the data attribute of the $ bitmap file and get its size.

If (read_mft_file ($ bitmap, pmftfile) <br/>{< br/> log_error ("Get MFT file failed"); <br/> goto error; <br/>}< br/> If (look_up_attr (at_data, & pmftfile, & ATTR )) <br/> {<br/> log_error ("can't get the bitmap data attribute! "); <Br/> goto error; <br/>}< br/> L = ntfs_get_attribute_value_length (ATTR); <br/>

With its size, we can read the content of the entire $ bitmap file.

First, the free space size of the entire partition is initialized to the size of the entire disk, which can be obtained through DRB.

Long long nr_free = m_dwltotalclusters;
Then we detect our $ bitmap content. If it is 1, our nr_free will be reduced by 1 until all the content of $ bitmap is detected.

If (ntfs_get_attribute_value (ATTR, Buf) = 0) <br/>{< br/> log_error ("Get partition free space failed! "); <Br/> goto error_buf; <br/>}< br/>{< br/> int I, j; <br/> for (I = 0; I <L; I ++) <br/> for (j = 0; j <8; j ++) <br/> If (BUF [I]> J) & 1) <br/> nr_free --; <br/>}< br/> free_size = nr_free * m_dwclustersize; <br/>

I use the ntfs_get_attribute_value (ATTR, Buf) function to read the content of the $ bitmap data with a very resident attribute to the Buf, and then calculate the free space size of the entire partition through a for loop.

The following shows how to obtain the NTFS partition size of about 20 GB and compare it with the partition size obtained in XP. As follows:

Program size:

The partition total size is: 20974463488
The partition free size is: 20906041344

XP:

 

The following is a comparison of NTFS partition sizes around M:

Program size:

The partition total size is: 205599232
The partition free size is: 202801152

 

XP:

 

We can see that the free space size of the partition obtained through the $ bitmap Metafile is very close to that of the free space obtained in XP. Therefore, we did not use the API in windows, by calculating $ bitmap in the NTFS file system, you can obtain the free space size of the entire partition. in Linux, you can obtain the partition size without loading the partition.

Next, I will explain how to calculate the free space size of the FAT32 and fat16 partitions. This computation is more troublesome than NTFS.