Given an NTFS File ID, is there any official way to get the file names

相关文章推荐

跑龙套的橡皮擦 · spring-boot +data ...· 10 月前 ·

深沉的苹果 · PgSQL 使用技巧总结 - 掘金· 1 年前 ·

酒量小的咖啡 · java & H5 语音技术实例· 1 年前 ·

高大的眼镜 · Vue中按钮组中多个按钮状态控制-同个按钮二 ...· 1 年前 ·

玩篮球的佛珠 · Pheatmap热图的绘制及如何调整图片_p ...· 1 年前 ·

If I have an NTFS File ID, is there an official way to get the file names from that file ID? (Other then scanning every file on the hard drive...?)
It appears that I can at least verify that a file ID is valid by calling NtCreateFile, although Microsoft's documentation has a big fat warning that the API is subject to change. OK, just taking a stab at it, could you use OpenFileById OpenFileById [ ^ ]to get you a handle, then GetFileInformationByHandleEx [ ^ ]to return a FILE_NAME_INFO [ ^ ]structure?
I would have thought there would be a way to get the name directly from the ID, but perhaps that capability is missing because FileIDs are re-used by the system so the same ID won't always point to the same file as time passes. If the system is static (read-only) this won't be a problem, but it still probably isn't a good practice. On NTFS the $MFT file itself has an entry for every file. The FileId has 16 bits of sequence number and 48-bits of $MFT file index. FileId => [seq << 48 | mft_index]. You can read $MFT records using

DeviceIoControl(hVolume, FSCTL_GET_NTFS_FILE_RECORD, ...) to obtain

NTFS_FILE_RECORD_OUTPUT_BUFFER and access its

FileRecordBuffer member which the NTFS info for the fileId in the

FileReferenceNumber parameter of the

NTFS_FILE_RECORD_OUTPUT_BUFFER matching the

NTFS_FILE_RECORD_INPUT_BUFFER unless the fileId is invalid.
The MFT is fairly well documented in many places on the web. That said, it is important to note that an MFT FILE-RECORD contains key-value pairs of attributes. Among the things in those attributes are the hardlink names, any reparse-point, and any NTFS streams (like a dir) that are part of that file.
Put another way, a given fileId can refer to multiple "file names" if it has multiple hardlinks pointing to it. So the canonical name is the first hardlink found in the key-value attributes of the $MFT record, which is then walked backward/up through the parent directory tree to build the canonical path to the file.

Read the question carefully.

Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.

If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.

Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question. Let's work to help developers, not make them feel stupid.