Upload FastSeekWpf/Core/MftReader.cs

FastSeekWpf/Core/MftReader.cs

@@ -3,6 +3,7 @@ using System.Buffers.Binary;
 using System.Collections.Generic;
 using System.IO;
 using System.Runtime.InteropServices;
+using System.Security.Principal;
 using FastSeekWpf.NativeInterop;
 
 namespace FastSeekWpf.Core;
@@ -11,6 +12,8 @@ public class MftReader : IDisposable
 {
     private readonly IntPtr _volumeHandle;
     private readonly NtfsDrive _drive;
+    private readonly int _recordSize;
+    private readonly long _mftByteOffset;
     private bool _disposed;
 
     private const int FallbackBuf = 4 * 1024 * 1024;
@@ -35,13 +38,58 @@ public class MftReader : IDisposable
             int err = Marshal.GetLastWin32Error();
             throw new IOException($"Failed to open volume {drive.DevicePath}: {Win32Error(err)} (code={err})");
         }
+
+        // Read boot sector once and cache record size + MFT offset
+        var bootInfo = ReadBootSector();
+        if (!bootInfo.HasValue)
+            throw new IOException("Failed to read NTFS boot sector");
+
+        _recordSize = bootInfo.Value.recordSize;
+        _mftByteOffset = bootInfo.Value.mftOffset;
     }
 
-    public ScanResult? ScanDirect()
+    // ------------------------------------------------------------------
+    //  Scan methods — try in order: $MFT file → volume raw → FSCTL
+    // ------------------------------------------------------------------
+
+    /// <summary>
+    /// Try all scan methods and return the first that works.
+    /// </summary>
+    public ScanResult ScanAny()
     {
-        int? recordSize = ReadMftRecordSize();
-        if (!recordSize.HasValue) return null;
+        // 1. Try $MFT file (fastest, matches Rust)
+        var direct = ScanDirect();
+        if (direct != null && direct.Records.Count > 0)
+        {
+            Logger.Log($"[{Drive.Letter}] Using direct $MFT file scan: {direct.Records.Count} records");
+            return direct;
+        }
 
+        // 2. Try reading raw from volume handle
+        var vol = ScanDirectVolume();
+        if (vol != null && vol.Records.Count > 0)
+        {
+            Logger.Log($"[{Drive.Letter}] Using volume raw scan: {vol.Records.Count} records");
+            return vol;
+        }
+
+        // 3. FSCTL fallback (slowest but most compatible)
+        var fallback = Scan();
+        if (fallback.Records.Count > 0)
+        {
+            Logger.Log($"[{Drive.Letter}] Using FSCTL fallback scan: {fallback.Records.Count} records");
+            return fallback;
+        }
+
+        Logger.Log($"[{Drive.Letter}] ALL scan methods returned 0 records");
+        return fallback;
+    }
+
+    /// <summary>
+    /// Direct $MFT file read. Matches Rust scan_direct().
+    /// </summary>
+    public ScanResult? ScanDirect()
+    {
         string mftPath = $"{_drive.Root}$MFT";
         Logger.Log($"[{Drive.Letter}] Opening $MFT file: {mftPath}");
 
@@ -63,55 +111,8 @@ public class MftReader : IDisposable
 
         try
         {
-            var records = new List<CompactRecord>();
-            var nameData = new List<char>();
-            byte[] buffer = new byte[DirectBuf];
-            ulong mftIndex = 0;
-            int leftover = 0;
-            long totalRead = 0;
-
-            while (true)
-            {
-                bool ok = Win32Api.ReadFile(
-                    mftHandle, buffer, leftover, (uint)(buffer.Length - leftover), out uint bytesRead, IntPtr.Zero);
-                if (!ok)
-                {
-                    int err = Marshal.GetLastWin32Error();
-                    Logger.Log($"[{Drive.Letter}] ReadFile failed at offset {totalRead}: {Win32Error(err)} (code={err})");
-                    break;
-                }
-                if (bytesRead == 0)
-                {
-                    Logger.Log($"[{Drive.Letter}] ReadFile returned 0 bytes at offset {totalRead} — EOF");
-                    break;
-                }
-
-                totalRead += bytesRead;
-                int total = leftover + (int)bytesRead;
-                int offset = 0;
-
-                while (offset + recordSize.Value <= total)
-                {
-                    bool applied = ApplyFixup(buffer, offset, recordSize.Value);
-                    if (applied)
-                    {
-                        ParseFileRecord(buffer.AsSpan(offset, recordSize.Value), mftIndex, records, nameData);
-                    }
-                    mftIndex++;
-                    offset += recordSize.Value;
-                }
-
-                offset = total - (total % recordSize.Value);
-                leftover = total - offset;
-                if (leftover > 0)
-                    Array.Copy(buffer, offset, buffer, 0, leftover);
-
-                if (mftIndex % 50000 == 0)
-                    Logger.Log($"[{Drive.Letter}] Progress: {mftIndex:N0} records parsed, {records.Count:N0} valid");
-            }
-
-            Logger.Log($"[{Drive.Letter}] Direct scan: {records.Count} records from {mftIndex} positions, {totalRead:N0} bytes read");
-            return new ScanResult(records, nameData);
+            var result = ScanFromHandle(mftHandle, "direct-file");
+            return result;
         }
         finally
         {
@@ -119,38 +120,107 @@ public class MftReader : IDisposable
         }
     }
 
-    public ScanResult Scan()
+    /// <summary>
+    /// Read MFT records directly from the volume handle at the boot-sector offset.
+    /// Fallback when $MFT file is blocked.
+    /// </summary>
+    public ScanResult? ScanDirectVolume()
     {
-        // Diagnostic: test FSCTL_QUERY_USN_JOURNAL first
-        Logger.Log($"[{Drive.Letter}] Diagnostic: testing FSCTL_QUERY_USN_JOURNAL...");
-        IntPtr journalBuf = Marshal.AllocHGlobal(Marshal.SizeOf<USN_JOURNAL_DATA_V0>());
+        Logger.Log($"[{Drive.Letter}] Attempting volume raw read at offset {_mftByteOffset}...");
+
+        bool ok = Win32Api.SetFilePointerEx(_volumeHandle, _mftByteOffset, out _, 0);
+        if (!ok)
+        {
+            int err = Marshal.GetLastWin32Error();
+            Logger.Log($"[{Drive.Letter}] Seek to MFT offset failed: {Win32Error(err)} (code={err})");
+            return null;
+        }
+
         try
         {
-            bool ok = Win32Api.DeviceIoControl(
-                _volumeHandle, Win32Api.FSCTL_QUERY_USN_JOURNAL,
-                IntPtr.Zero, 0,
-                journalBuf, (uint)Marshal.SizeOf<USN_JOURNAL_DATA_V0>(),
-                out uint bytesReturned, IntPtr.Zero);
-            if (ok)
+            var result = ScanFromHandle(_volumeHandle, "direct-volume");
+            return result;
+        }
+        catch (Exception ex)
+        {
+            Logger.Log($"[{Drive.Letter}] Volume raw read failed: {ex.Message}");
+            return null;
+        }
+    }
+
+    /// <summary>
+    /// Common scan loop used by both direct-file and direct-volume.
+    /// </summary>
+    private ScanResult ScanFromHandle(IntPtr handle, string methodName)
+    {
+        var records = new List<CompactRecord>();
+        var nameData = new List<char>();
+        byte[] buffer = new byte[DirectBuf];
+        ulong mftIndex = 0;
+        int leftover = 0;
+        long totalRead = 0;
+
+        while (true)
+        {
+            bool ok = Win32Api.ReadFile(
+                handle, buffer, leftover, (uint)(buffer.Length - leftover), out uint bytesRead, IntPtr.Zero);
+            if (!ok)
             {
-                var journalData = Marshal.PtrToStructure<USN_JOURNAL_DATA_V0>(journalBuf);
-                Logger.Log($"[{Drive.Letter}] USN journal OK: ID={journalData.UsnJournalID}, NextUsn={journalData.NextUsn}, Active=YES");
+                int err = Marshal.GetLastWin32Error();
+                if (err == 38) // ERROR_HANDLE_EOF
+                {
+                    Logger.Log($"[{Drive.Letter}] {methodName}: EOF at offset {totalRead}");
+                    break;
+                }
+                Logger.Log($"[{Drive.Letter}] {methodName}: ReadFile failed at offset {totalRead}: {Win32Error(err)} (code={err})");
+                break;
             }
-            else
+            if (bytesRead == 0)
             {
-                int err = Marshal.GetLastWin32Error();
-                Logger.Log($"[{Drive.Letter}] FSCTL_QUERY_USN_JOURNAL failed: {Win32Error(err)} (code={err})");
+                Logger.Log($"[{Drive.Letter}] {methodName}: ReadFile returned 0 bytes at offset {totalRead} — EOF");
+                break;
             }
-        }
-        finally
-        {
-            Marshal.FreeHGlobal(journalBuf);
+
+            totalRead += bytesRead;
+            int total = leftover + (int)bytesRead;
+            int offset = 0;
+
+            while (offset + _recordSize <= total)
+            {
+                bool applied = ApplyFixup(buffer, offset, _recordSize);
+                if (applied)
+                {
+                    ParseFileRecord(buffer.AsSpan(offset, _recordSize), mftIndex, records, nameData);
+                }
+                mftIndex++;
+                offset += _recordSize;
+            }
+
+            offset = total - (total % _recordSize);
+            leftover = total - offset;
+            if (leftover > 0)
+                Array.Copy(buffer, offset, buffer, 0, leftover);
+
+            if (mftIndex % 50000 == 0)
+                Logger.Log($"[{Drive.Letter}] {methodName}: {mftIndex:N0} records parsed, {records.Count:N0} valid");
         }
 
+        Logger.Log($"[{Drive.Letter}] {methodName}: {records.Count} records from {mftIndex} positions, {totalRead:N0} bytes read");
+        return new ScanResult(records, nameData);
+    }
+
+    /// <summary>
+    /// FSCTL_ENUM_USN_DATA fallback.
+    /// </summary>
+    public ScanResult Scan()
+    {
         Logger.Log($"[{Drive.Letter}] Starting FSCTL_ENUM_USN_DATA fallback...");
         Logger.Log($"[{Drive.Letter}] MFT_ENUM_DATA_V0 size = {Marshal.SizeOf<MFT_ENUM_DATA_V0>()} bytes");
         Logger.Log($"[{Drive.Letter}] USN_RECORD_V2 size = {Marshal.SizeOf<USN_RECORD_V2>()} bytes");
 
+        // Diagnostic: test FSCTL_QUERY_USN_JOURNAL
+        TestUsnJournal();
+
         var records = new List<CompactRecord>();
         var nameData = new List<char>();
         byte[] buffer = new byte[FallbackBuf];
@@ -196,10 +266,6 @@ public class MftReader : IDisposable
                             buffer = new byte[buffer.Length * 2];
                             continue;
                         }
-                        if (error == 1) // ERROR_INVALID_FUNCTION
-                        {
-                            Logger.Log($"[{Drive.Letter}] FSCTL_ENUM_USN_DATA: ERROR_INVALID_FUNCTION — struct/IOCTL mismatch or journal not active");
-                        }
                         Logger.Log($"[{Drive.Letter}] FSCTL_ENUM_USN_DATA failed (iter {iterations}): {Win32Error(error)} (code={error})");
                         break;
                     }
@@ -260,7 +326,43 @@ public class MftReader : IDisposable
         return new ScanResult(records, nameData);
     }
 
-    private int? ReadMftRecordSize()
+    // ------------------------------------------------------------------
+    //  Diagnostics
+    // ------------------------------------------------------------------
+
+    private void TestUsnJournal()
+    {
+        Logger.Log($"[{Drive.Letter}] Diagnostic: testing FSCTL_QUERY_USN_JOURNAL...");
+        IntPtr journalBuf = Marshal.AllocHGlobal(Marshal.SizeOf<USN_JOURNAL_DATA_V0>());
+        try
+        {
+            bool ok = Win32Api.DeviceIoControl(
+                _volumeHandle, Win32Api.FSCTL_QUERY_USN_JOURNAL,
+                IntPtr.Zero, 0,
+                journalBuf, (uint)Marshal.SizeOf<USN_JOURNAL_DATA_V0>(),
+                out uint bytesReturned, IntPtr.Zero);
+            if (ok)
+            {
+                var journalData = Marshal.PtrToStructure<USN_JOURNAL_DATA_V0>(journalBuf);
+                Logger.Log($"[{Drive.Letter}] USN journal OK: ID={journalData.UsnJournalID}, NextUsn={journalData.NextUsn}");
+            }
+            else
+            {
+                int err = Marshal.GetLastWin32Error();
+                Logger.Log($"[{Drive.Letter}] FSCTL_QUERY_USN_JOURNAL failed: {Win32Error(err)} (code={err})");
+            }
+        }
+        finally
+        {
+            Marshal.FreeHGlobal(journalBuf);
+        }
+    }
+
+    // ------------------------------------------------------------------
+    //  NTFS helpers
+    // ------------------------------------------------------------------
+
+    private (int recordSize, long mftOffset)? ReadBootSector()
     {
         Logger.Log($"[{Drive.Letter}] Reading boot sector from volume...");
         Win32Api.SetFilePointerEx(_volumeHandle, 0, out _, 0);
@@ -276,7 +378,7 @@ public class MftReader : IDisposable
 
         if (boot[3] != 'N' || boot[4] != 'T' || boot[5] != 'F' || boot[6] != 'S')
         {
-            Logger.Log($"[{Drive.Letter}] Not NTFS (missing signature at offset 3): bytes={boot[3]},{boot[4]},{boot[5]},{boot[6]}");
+            Logger.Log($"[{Drive.Letter}] Not NTFS (missing signature at offset 3)");
             return null;
         }
 
@@ -284,11 +386,13 @@ public class MftReader : IDisposable
         byte sectorsPerCluster = boot[0x0D];
         int clusterSize = bytesPerSector * sectorsPerCluster;
 
+        long mftStartLcn = BinaryPrimitives.ReadInt64LittleEndian(boot.AsSpan(0x30, 8));
         sbyte raw = (sbyte)boot[0x40];
         int recordSize = raw > 0 ? raw * clusterSize : 1 << (-raw);
+        long mftOffset = mftStartLcn * clusterSize;
 
-        Logger.Log($"[{Drive.Letter}] Boot OK: bps={bytesPerSector}, spc={sectorsPerCluster}, clusterSize={clusterSize}, recordSize={recordSize}");
-        return recordSize;
+        Logger.Log($"[{Drive.Letter}] Boot OK: bps={bytesPerSector}, spc={sectorsPerCluster}, clusterSize={clusterSize}, recordSize={recordSize}, mftLcn={mftStartLcn}, mftOffset={mftOffset}");
+        return (recordSize, mftOffset);
     }
 
     private static bool ApplyFixup(byte[] record, int offset, int recordSize)