Upload FastSeekWpf/Core/MftReader.cs

FastSeekWpf/Core/MftReader.cs

@@ -13,24 +13,23 @@ public class MftReader : IDisposable
     private readonly NtfsDrive _drive;
     private bool _disposed;
 
-    private const int ChunkSize = 256 * 1024; // 256KB — large enough for speed, small enough for memory
-
     public NtfsDrive Drive => _drive;
 
     public MftReader(NtfsDrive drive)
     {
         _drive = drive;
-        // NOTE: FILE_FLAG_NO_BUFFERING removed. It requires sector-aligned buffers AND
-        // aligned file offsets, and .NET arrays are not guaranteed aligned. The Rust
-        // code likely opens the volume without NO_BUFFERING. Buffered reads are fast
-        // enough since we now read exactly the MFT size, not the whole volume.
+
+        // FILE_FLAG_BACKUP_SEMANTICS is REQUIRED for opening a volume device
+        // for direct MFT reads. FILE_FLAG_NO_BUFFERING is removed because .NET
+        // arrays are not guaranteed sector-aligned, and unaligned reads with
+        // NO_BUFFERING hang forever or return ERROR_INVALID_PARAMETER.
         _volumeHandle = Win32Api.CreateFileW(
             drive.DevicePath,
             Win32Api.GENERIC_READ,
             Win32Api.FILE_SHARE_READ | Win32Api.FILE_SHARE_WRITE | Win32Api.FILE_SHARE_DELETE,
             IntPtr.Zero,
             Win32Api.OPEN_EXISTING,
-            0, // FILE_ATTRIBUTE_NORMAL — buffered, cached reads
+            Win32Api.FILE_FLAG_BACKUP_SEMANTICS,
             IntPtr.Zero);
 
         if (_volumeHandle == new IntPtr(-1))
@@ -38,20 +37,27 @@ public class MftReader : IDisposable
             int err = Marshal.GetLastWin32Error();
             throw new IOException($"Failed to open volume {drive.DevicePath}: {Win32Error(err)}");
         }
+
+        Logger.Log($"Volume {drive.DevicePath} opened OK, handle=0x{_volumeHandle:X}");
     }
 
     /// <summary>
-    /// Direct MFT read: parse boot sector, seek to MFT start, read first record
-    /// to discover MFT $DATA size, then read exactly that many bytes.
+    /// Direct MFT read matching the Rust implementation.
     /// </summary>
     public ScanResult ScanDirect()
     {
+        Logger.Log($"[{Drive.Letter}] Reading boot sector...");
+
         // ── 1. Boot sector ──
         byte[] boot = new byte[512];
         bool ok = Win32Api.ReadFile(_volumeHandle, boot, 512, out uint br, IntPtr.Zero);
         if (!ok || br < 512)
-            throw new IOException($"Failed to read boot sector: {Win32Error(Marshal.GetLastWin32Error())}");
+        {
+            int err = Marshal.GetLastWin32Error();
+            throw new IOException($"Failed to read boot sector: {Win32Error(err)}");
+        }
 
+        // Validate NTFS signature at offset 3: "NTFS    "
         if (boot[3] != 'N' || boot[4] != 'T' || boot[5] != 'F' || boot[6] != 'S')
             throw new IOException("Not an NTFS volume (missing NTFS signature)");
 
@@ -67,103 +73,95 @@ public class MftReader : IDisposable
         int recordSize = raw < 0 ? 1 << (-raw) : raw * clusterSize;
 
         long mftByteOffset = mftStartLcn * clusterSize;
-        Logger.Log($"Boot: bps={bytesPerSector}, spc={sectorsPerCluster}, clusterSize={clusterSize}, mftLcn={mftStartLcn}, recordSize={recordSize}");
+        Logger.Log($"[{Drive.Letter}] Boot: bps={bytesPerSector}, spc={sectorsPerCluster}, clusterSize={clusterSize}, mftLcn={mftStartLcn}, recordSize={recordSize}, offset={mftByteOffset}");
 
-        // ── 2. Seek to MFT and read first record ($MFT itself) ──
+        // ── 2. Seek to MFT ──
         ok = Win32Api.SetFilePointerEx(_volumeHandle, mftByteOffset, out _, 0);
         if (!ok)
             throw new IOException($"Seek to MFT offset {mftByteOffset} failed: {Win32Error(Marshal.GetLastWin32Error())}");
 
+        // ── 3. Read first record ($MFT itself) to get data size ──
+        Logger.Log($"[{Drive.Letter}] Reading first MFT record to find $DATA size...");
         byte[] firstRecord = new byte[recordSize];
         ok = Win32Api.ReadFile(_volumeHandle, firstRecord, (uint)recordSize, out br, IntPtr.Zero);
         if (!ok || br < recordSize)
             throw new IOException($"Failed to read first MFT record: {Win32Error(Marshal.GetLastWin32Error())}");
 
-        // ── 3. Parse MFT total data size from its own $DATA attribute ──
         long mftDataSize = ParseMftDataSize(firstRecord);
         if (mftDataSize <= 0)
         {
-            Logger.Log("WARNING: Could not parse MFT $DATA size; using 2GB fallback. " +
-                       "This may read past the end of the MFT.");
+            Logger.Log($"[{Drive.Letter}] WARNING: Could not parse MFT $DATA size; using 2GB fallback.");
             mftDataSize = 2L * 1024 * 1024 * 1024;
         }
         else
         {
-            Logger.Log($"MFT data size from $DATA attribute: {mftDataSize:N0} bytes ({mftDataSize / 1024.0 / 1024.0:F1} MB)");
+            Logger.Log($"[{Drive.Letter}] MFT data size: {mftDataSize:N0} bytes ({mftDataSize / 1024.0 / 1024.0:F1} MB)");
         }
 
-        // ── 4. Reset to MFT start and read exactly mftDataSize bytes ──
+        // ── 4. Seek back to MFT start and read all records ──
         ok = Win32Api.SetFilePointerEx(_volumeHandle, mftByteOffset, out _, 0);
         if (!ok)
             throw new IOException($"Seek back to MFT start failed: {Win32Error(Marshal.GetLastWin32Error())}");
 
         var records = new List<CompactRecord>();
         var nameData = new List<char>();
-        byte[] chunk = new byte[ChunkSize];
+        byte[] buffer = new byte[recordSize]; // read one record at a time for safety
         ulong mftIndex = 0;
         long bytesRemaining = mftDataSize;
         int consecutiveInvalid = 0;
         const int MaxConsecutiveInvalid = 50;
 
+        Logger.Log($"[{Drive.Letter}] Starting MFT read loop...");
+
         while (bytesRemaining > 0 && consecutiveInvalid < MaxConsecutiveInvalid)
         {
-            int toRead = (int)Math.Min(ChunkSize, bytesRemaining);
-            ok = Win32Api.ReadFile(_volumeHandle, chunk, (uint)toRead, out uint bytesRead, IntPtr.Zero);
+            ok = Win32Api.ReadFile(_volumeHandle, buffer, (uint)recordSize, out br, IntPtr.Zero);
             if (!ok)
             {
                 int err = Marshal.GetLastWin32Error();
                 if (err == 38) // ERROR_HANDLE_EOF
                 {
-                    Logger.Log("MFT read: EOF reached");
+                    Logger.Log($"[{Drive.Letter}] MFT read: EOF reached");
                     break;
                 }
-                Logger.Log($"ReadFile failed at offset {mftByteOffset + (mftDataSize - bytesRemaining)}: {Win32Error(err)} — stopping");
+                Logger.Log($"[{Drive.Letter}] ReadFile failed at offset {mftByteOffset + (mftDataSize - bytesRemaining)}: {Win32Error(err)} — stopping");
                 break;
             }
-            if (bytesRead == 0)
+            if (br == 0)
             {
-                Logger.Log("ReadFile returned 0 bytes — stopping");
+                Logger.Log($"[{Drive.Letter}] ReadFile returned 0 bytes — stopping");
                 break;
             }
 
-            bytesRemaining -= bytesRead;
-            int offset = 0;
-            int total = (int)bytesRead;
+            bytesRemaining -= br;
 
-            while (offset + recordSize <= total)
+            if (ApplyFixup(buffer, recordSize))
             {
-                var span = new ReadOnlySpan<byte>(chunk, offset, recordSize);
-                if (ApplyFixup(span, recordSize))
-                {
-                    ParseFileRecord(span, mftIndex, records, nameData);
-                    consecutiveInvalid = 0;
-                }
-                else
-                {
-                    consecutiveInvalid++;
-                }
-                mftIndex++;
-                offset += recordSize;
-
-                if (consecutiveInvalid >= MaxConsecutiveInvalid)
-                {
-                    Logger.Log($"Stopping after {MaxConsecutiveInvalid} consecutive invalid records at index {mftIndex}");
-                    bytesRemaining = 0;
-                    break;
-                }
+                ParseFileRecord(buffer.AsSpan(), mftIndex, records, nameData);
+                consecutiveInvalid = 0;
+            }
+            else
+            {
+                consecutiveInvalid++;
             }
+
+            mftIndex++;
+
+            if (mftIndex % 10000 == 0)
+                Logger.Log($"[{Drive.Letter}] Progress: {mftIndex:N0} records, {records.Count:N0} valid, {bytesRemaining:N0} bytes remaining");
         }
 
-        Logger.Log($"MFT scan complete: {records.Count:N0} records from {mftIndex:N0} positions ({mftDataSize - bytesRemaining:N0} bytes read)");
+        Logger.Log($"[{Drive.Letter}] MFT scan complete: {records.Count:N0} records from {mftIndex:N0} positions");
         return new ScanResult(records, nameData);
     }
 
     /// <summary>
-    /// Fallback FSCTL_ENUM_USN_DATA scan. Kept for parity but direct scan should
-    /// be preferred — it is faster and doesn't require a USN journal.
+    /// Fallback FSCTL_ENUM_USN_DATA scan.
     /// </summary>
     public ScanResult Scan()
     {
+        Logger.Log($"[{Drive.Letter}] Starting FSCTL fallback scan...");
+
         var records = new List<CompactRecord>();
         var nameData = new List<char>();
         byte[] buffer = new byte[4 * 1024 * 1024];
@@ -200,12 +198,12 @@ public class MftReader : IDisposable
                         int error = Marshal.GetLastWin32Error();
                         if ((uint)error == 0x26) // ERROR_HANDLE_EOF
                         {
-                            Logger.Log($"FSCTL_ENUM_USN_DATA: EOF after {iterations} iterations");
+                            Logger.Log($"[{Drive.Letter}] FSCTL_ENUM_USN_DATA: EOF after {iterations} iterations");
                             break;
                         }
                         if (error == 122) // ERROR_INSUFFICIENT_BUFFER
                         {
-                            Logger.Log("FSCTL_ENUM_USN_DATA: insufficient buffer, retrying with larger buffer");
+                            Logger.Log($"[{Drive.Letter}] FSCTL_ENUM_USN_DATA: insufficient buffer, retrying with larger buffer");
                             buffer = new byte[buffer.Length * 2];
                             continue;
                         }
@@ -216,7 +214,7 @@ public class MftReader : IDisposable
 
                     if (bytesReturned <= 8)
                     {
-                        Logger.Log($"FSCTL_ENUM_USN_DATA: {bytesReturned} bytes returned, stopping");
+                        Logger.Log($"[{Drive.Letter}] FSCTL_ENUM_USN_DATA: {bytesReturned} bytes returned, stopping");
                         break;
                     }
 
@@ -265,22 +263,17 @@ public class MftReader : IDisposable
             Marshal.FreeHGlobal(enumDataPtr);
         }
 
-        Logger.Log($"FSCTL scan complete: {records.Count} records");
+        Logger.Log($"[{Drive.Letter}] FSCTL scan complete: {records.Count} records");
         return new ScanResult(records, nameData);
     }
 
     // ── Helpers ──
 
-    /// <summary>
-    /// Parses the $DATA attribute (0x80) from the $MFT record itself (record 0)
-    /// to discover the total size of the MFT data on disk.
-    /// </summary>
     private static long ParseMftDataSize(ReadOnlySpan<byte> record)
     {
         if (record.Length < 48 || record[0] != 'F' || record[1] != 'I' || record[2] != 'L' || record[3] != 'E')
             return -1;
 
-        // Apply fixup first so the record is valid
         if (!ApplyFixup(record, record.Length))
             return -1;